text: TEC assesses, identifies, and manages material risks from cybersecurity threats under the governance of its Cyber Security Framework and Information Security Policy, as well as several related policies and procedures addressing areas such as threat vulnerability management, cyber risk management, data protection and classification, network security, access control, incident response, security awareness, employee training and asset management. These policies and related standards require identification of all Information Technology (IT) and Operational Technology (OT) critical facilities and/or cyber assets, and sufficient controls for IT and OT asset inventory, including responsibilities for assets, information owners, and asset disposition processes. From a security perspective, TEC's Information Security group is directed at protecting all aspects of data and how information is stored, transmitted, processed, and used in business processes. TEC's Corporate Security group is responsible for protecting physical assets including critical facilities, protection of employees, and related physical security risks.

companyName: TAMPA ELECTRIC CO


text: Monitor Cybersecurity Incidents Our internal cybersecurity control group meets monthly or on a more frequent basis if needed, to discuss and assess risks related to cybersecurity threats and review any reported cybersecurity incidents. The reviews include a review of the incident log, assessments of risks identified by multiple independent third parties and a review of our cyber risk as well as cybersecurity threat modeling. Identified risks related to cybersecurity threats are further analyzed as part of our enterprise risk management process. Our employees are provided with regular security policy and security awareness training including identifying potential cybersecurity incidents and reporting them to our security incident response team.

companyName: ACACIA RESEARCH CORP

ticker: ACTG

secItem: Item 1C


text: The Company's CISO is primarily responsible for the implementation of defense capabilities and risk mitigation strategies. The Company's CISO, Timothy J. Held, has over 26 years of information technology and cybersecurity experience. He holds the title of Executive Vice President and Chief Information Security Officer and has been in his role since 2018, having served as the Company's Deputy CISO from 2015 to 2018 and Head of Cyber Defense, Threat Intelligence, and Incident Response from 2012 to 2018. The CISO is supported by his direct reports and their teams, many of whom hold cybersecurity-related certifications.

companyName: US BANCORP \DE\

ticker: USB


text: Related to Cybersecurity Risks Our cybersecurity program and related operations and processes are directed by our Executive Director of Information Technology, whom we refer to as the IT Director. Currently, the IT Director role is held by an individual who has over 15 years of cybersecurity, information technology, and systems engineering experience. The Director of IT reports to our management – currently the Chief Business Officer.

companyName: Esperion Therapeutics, Inc.

ticker: ESPR


text: The Company's cybersecurity program is overseen by a dedicated global team of cybersecurity professionals, led by the CISO who brings over 20 years of information technology and cybersecurity leadership experience and holds the Certified Information Security Manager ("CISM") designation. The CISO reports directly to the Chief Information Officer ("CIO") and is responsible for leading the execution of the Company's cybersecurity strategy.

companyName: ILLINOIS TOOL WORKS INC

ticker: ITW


text: Once a cybersecurity incident is contained, our focus shifts to remediation and recovery. These activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions, validation of files or data that may have been affected, increased network monitoring or logging to identify recurring attacks, monitoring dark or deep web forums, reconfiguring administrative account access, hardening network security such as firewall configurations, and employee re-training. We also maintain cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.

companyName: Public Storage

ticker: PSA


text: We have established separate processes and procedures to oversee and identify cybersecurity risks associated with our use of third -party service providers. All third parties involved in our cybersecurity risk assessments and risk management are required to provide reports designed to allow us to monitor and assess such third parties' security controls.

companyName: NATURAL RESOURCE PARTNERS LP

ticker: NRP


text: Since 2015, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.

companyName: SYNOPSYS INC

ticker: SNPS


text: In the ordinary course of business, we receive, process, use, and store digitally large amounts of data, including confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to us and our business operations. To this end, we have implemented policies designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them. While we have taken measures designed to protect the security of the confidential and personal information under our control, we cannot provide absolute assurance that any security measures that we or our third-party service providers have implemented will be effective against current or future security threats.

companyName: Mobiquity Technologies, Inc.

ticker: MOBQ


text: Avanos has implemented a comprehensive cybersecurity program to identify, assess and manage material risks from cybersecurity threats. In addition, we have instituted executive management and board oversight of the risks arising from cybersecurity threats. Cybersecurity Risk Management and Strategy.

companyName: AVANOS MEDICAL, INC.

ticker: AVNS


text: In addition, the Board will oversee any cybersecurity risk management framework and a dedicated committee of the Board or an officer appointed by the Board will review and approve any cybersecurity policies, strategies and risk management practices. The Board (or designated committee or officer) will receive periodic updates on cybersecurity risks, including emerging threats, mitigation efforts and incident response activities. The updates will be provided at least annually, or more frequently as needed, to ensure cybersecurity risks are appropriately managed and integrated into our broader risk oversight strategy.

companyName: Rubber Leaf Inc

ticker: RLEA


text: For further information on risks to the Company from cybersecurity threats, see "Our information systems may experience failure, interruption or breach in security" under Item 1A. Risk Factors.

companyName: SUMMIT FINANCIAL GROUP, INC.


text: The Chief Information Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. The Chief Information Officer and the Director of Privacy are also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Additionally, the Cybersecurity and Privacy Committee reviews and has oversight over these functions.

companyName: Arlo Technologies, Inc.

ticker: ARLO


text: The Board has the primary responsibility for overseeing and reviewing the guidelines and policies with respect to risk management, including cybersecurity. The Board receives quarterly updates to the Cybersecurity Program from the Company's management. These updates include the results of the cybersecurity risk assessments, the planning and results of the periodic testing by our third-party IT and cybersecurity consultants, updates and enhancements to the Cybersecurity Program and the Incident Response Plan, and reporting of additional cybersecurity data metrics.

companyName: CAPITAL SOUTHWEST CORP

ticker: CSWC


text: While we have experienced cybersecurity incidents in the past, to date, none have materially affected, or reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial position. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors-- More General Risks Applicable to Our Industry."

companyName: SHYFT GROUP, INC.


text: h. Maintaining a program to identify cybersecurity risks associated with certain third party vendors, which is one component of an overall vendor risk management program.

companyName: HUMANA INC

ticker: HUM


text: Our Board has overall oversight responsibility for our risk management and has delegated cybersecurity risk management oversight to the Audit Committee. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and procedures to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee also reports material cybersecurity risks to our full Board. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining our cybersecurity program. Our cybersecurity program is managed under the direction of our Senior Vice President for Business Transformation, who receives reports from our cybersecurity team, including our Chief Information Security Officer, or CISO, and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. The CISO, in coordination with senior management, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to respond promptly to any material cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications, the CISO and these teams inform senior management about, and monitor the prevention, detection, mitigation and remediation of, cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.

companyName: Pactiv Evergreen Inc.


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our process. Our cybersecurity risk assessment is part of our overall risk management program. We also regularly engage outside consultants to assess, identify and manage material risks from cybersecurity threats, including those threats associated with our use of third-party service providers. These consultants recommend and help implement systems to protect against cybersecurity threats. Based on the information available as of the filing date of this Annual Report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our cybersecurity risk management processes, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us. Refer to the risk factor captioned "Increasing dependence on the continuous and reliable operation of our information technology systems" under PART I, ITEM 1A – RISK FACTORS for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: IMMUCELL CORP /DE/

ticker: ICCC


text: We maintain a cybersecurity program that includes development and implementation of policies, procedures and tools designed to help ensure availability of critical operations, information technology and telecommunication systems and safeguard sensitive information. The cybersecurity program is assessed against industry standards, including certain Center for Internet Security critical security controls. This assessment is conducted by a third party periodically and internally at least annually. We are also required to comply with cybersecurity standards under the North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection and by the Department of Homeland Security Transportation Security Administration. We also periodically collaborate with federal and state law enforcement experts, external assessors, consultants, industry peers and other third parties in connection with understanding market and threat conditions used to identify, assess and mitigate cybersecurity risks.

companyName: WISCONSIN POWER & LIGHT CO


text: Verizon's Management Audit Committee (VMAC), which includes our CFO, Senior Vice President of Internal Audit and other senior executives, is responsible for overseeing components of our overall risk management strategy. The VMAC receives quarterly updates from the CISO on Verizon's cybersecurity program.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and evaluate the effectiveness of our safeguards at least semi-annually. We devote significant resources and designate high-level personnel, including our Chief Information Officer who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: BlackSky Technology Inc.

ticker: BKSY


text: We face ongoing risks that, if realized, could materially impact our business, operations and financial results. See our risk factor disclosures in Item 1A of this Annual Report on Form 10-K under the heading "Information Technology and Systems," which are incorporated by reference herein. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the company, including our business strategy, results of operations, or financial condition.

companyName: 1 800 FLOWERS COM INC

ticker: FLWS


text: Internally, the CISO coordinates oversight of reviewing security alerts, identifying and monitoring ongoing and potential cybersecurity threats, evaluating strategic business impacts of cybersecurity threats and developing programs and initiatives to educate the Company's employees regarding cybersecurity. The CISO also manages the Company's Security Incident Response Plan (the "Incident Response Plan"), which outlines action steps for the preparation, identification, triage, analysis, containment, eradication, recovery and reflection stages of a cybersecurity incident. The Incident Response Plan serves as the charter for the Company's Security Incident Response Team (the "Incident Response Team"), which includes a strategic team comprised of executives from various cross-functional management teams, as well as a tactical team comprised of internal technical support roles and external third-party service providers. The Incident Response Plan provides how the Incident Response Team will analyze and, as necessary, escalate cybersecurity incidents both internally and with third-party service providers based on type and severity of the specific incident.

companyName: Builders FirstSource, Inc.

ticker: BLDR


text: Under the oversight of the Board of Directors, we regularly undertake enterprise risk assessments and have implemented policies, procedures, and programs designed to help manage the risks to which we are exposed in our business, including cybersecurity risks. As part of our enterprise risk management process, we have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems, as well as the systems of third parties on whom we rely, such as our cloud hosting partners. Our cybersecurity program is designed to assess, identify, and manage material risks and vulnerabilities to our security posture, including prioritizing and remediating cybersecurity risks. Our program calls for, among other things: • incorporation of cybersecurity in our overall enterprise risk management processes, including periodic enterprise risk assessments and tools used to track and monitor risks; • regular reviews of cybersecurity risks and mitigation efforts specifically; • use of software and hardware tools and services to help safeguard our systems and product offerings; • certifications or conformance for certain products and services; and • assessments designed to help identify cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment.

companyName: VERINT SYSTEMS INC


text: Additionally, the Company leverages insights from independently-conducted penetration testing provided by external third-party assessors, as required by NY Department of Financial Services (DFS) cybersecurity regulations, to discover and evaluate potential vulnerabilities across the enterprise that should be contemplated within the overall cyber risk program. The Company also engages independent third-party auditors to provide additional subject matter expertise, as well as to perform comprehensive independent audits of the Program. Audits are conducted no less than annually to evaluate the effectiveness and maturity of the Program. Audits include a review of the cyber risk assessment process, security control effectiveness, and compliance with regulatory requirements.

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: Our Cybersecurity Team Our management is responsible for assessing, managing and mitigating all risks relative to our business, including material risks from cybersecurity threats. Within our management team, assessment, management, and mitigation of cybersecurity threats is primarily overseen by our technology group, which has extensive experience in cybersecurity, technology, and digital grid operations. Our technology group is led by Joel Austin, our senior vice president and chief digital officer, and Malia Hodges, our senior vice president and chief information officer. Mr. Austin has over 34 years of technology operations, utility industry, and leadership experience, including more than 15 years of cybersecurity oversight experience. Ms. Hodges has 25 years of technology operations, utility industry, and leadership experience, including six years as our chief information officer, with responsibility in that role for management of Oncor's technology function, including cybersecurity. Both Mr. Austin and Ms. Hodges are long-time members of the Edison Electric Institute security and technology policy committee, which focuses on working with federal agencies on cybersecurity risks relevant to the electric industry. Mr. Austin has testified on cybersecurity issues facing the State of Texas and the electric utility industry in front of multiple Texas legislative sub-committees and been asked to discuss cybersecurity risks with members of the US Congress. Mr. Austin and Ms. Hodges also work closely and regularly with PUCT staff and PUCT commissioners on cybersecurity risks and mitigations. We also have a designated chief information security officer who has over 42 years of experience in cybersecurity, a master's degree in cybersecurity and a doctorate degree in cybersecurity/information assurance. Within our technology group, we maintain a dedicated cybersecurity group and 24/7/365 team that responds to and protects against cybersecurity risks. Our collective cybersecurity staff consists of a group of employees and contractors located inside and outside the state of Texas with a wide range of specialized skills and experience, including through service in the United States military and federal agencies, cybersecurity-related certifications, membership and advisory and board positions with industry groups and non-profit organizations focused on cybersecurity, and training in the cyber defense tools and methods we deploy, as well as various higher education degrees related to cybersecurity.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: As of the date of this Annual Report, we have not experienced any information security incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition, and we have not identified any current cybersecurity threats that we believe are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Alkermes plc.

ticker: ALKS


text: The secure processing, maintenance and transmission of sensitive data, including confidential and other proprietary information about our business and our employees, customers, suppliers and business partners, is important to our operations and business strategy. As a result, cybersecurity and data protection are key components of our long-term strategy.

companyName: ON SEMICONDUCTOR CORP

ticker: ON


text: b.protecting AT&T-owned and -managed assets and resources against unauthorized access by monitoring potential security threats, correlating network events, and overseeing the execution of corrective actions;

companyName: AT&T INC.

ticker: T


text: Cybersecurity Threat Disclosure While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that has had a material impact on our business or operations, there can be no guarantee that we will not experience an incident that results in a material impact to our business or operations in the future. In addition, cybersecurity threats are constantly evolving and increasing in sophistication, which increases the difficulty of successfully defending against them or implementing adequate preventative measures. Refer to Part I, Item 1A. Risk Factors for further discussion of cybersecurity risks.

companyName: International Stem Cell CORP

ticker: ISCO


text: Our information security function is led by our Director of Information Technology (IT Director), who reports to our Chief Financial Officer (CFO), and is supported by our third party security consultant, and it helps identify, assess and manage the Company's cybersecurity threats and risks. The information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example automated tools, subscribing to reports and services that identify certain cybersecurity threats, conducting threat assessments for internal and external threats, engaging third parties for threat assessments, and conducting assessments to identify vulnerabilities. Our assessment and management of material risks from cybersecurity threats are integrated into our risk management processes. For example, our IT Director and certain management, including our CFO, evaluate material risks from cybersecurity threats against our overall business objectives and our CFO periodically reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.

companyName: IN8BIO, INC.

ticker: INAB


text: The information security and third-party risk management programs of the Company are managed by the CISO who is a member of the Company's Risk Management Department, reporting directly to the Company's Chief Risk Officer who reports directly to the Chief Executive Officer. The CISO's responsibilities include: maintaining the information security risk assessment and related reports to management; monitoring reasonably foreseeable threats, internal and external, that could result in unauthorized disclosure, misuse, alteration or destruction of customer information or data systems; overseeing the development, implementation, enforcement and maintenance of the ISPP; implementing appropriate changes to the program in response to industry or regulatory mandates; monitoring the entire ISPP, reviewing it at least annually, and adjusting as necessary for changing regulation, technology, personnel, procedures and business arrangements; reporting the status of the ISPP periodically; ensuring information security awareness training is provided to all employees on a regular basis; ensuring the ISPP assessments are updated to include control changes for existing/new products, processes, and systems reflecting the associated changes to risk and mitigation methodology; providing guidance to management on emerging risks, cyber threats and regulatory changes; and maintaining information security program strategic goals in alignment with IT and PFC business strategy.

companyName: PREMIER FINANCIAL CORP


text: The Audit Committee reports to our full Board regarding its activities, including those related to cybersecurity. Our Board of Directors also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our chief information security officer or external experts as part of the Board of Directors' continuing education on topics that impact public companies.

companyName: BOX INC

ticker: BOX


text: We seek to enhance our policies and practices to protect our platforms, adapt to changes in regulations, identify potential and emerging security risks and develop mitigation strategies for those risks. For example, we conduct regular risk assessments at planned intervals for high priority systems and/or applications to identify and analyze threats and vulnerabilities, identify controls, identify risk ratings and likelihood and level of potential impact, and provide recommendations for risk reduction, mitigation, acceptance, and avoidance. As part of our overall risk mitigation strategy, we also maintain cyber liability insurance coverage.

companyName: TechTarget, Inc.

ticker: TTGT


text: As part of the Board's risk oversight process, senior management meets with the Board or Audit Committee at least twice annually to provide updates on and discuss cybersecurity. Such updates include a review of the companies' cybersecurity strategy, a scan of the threat landscape, and recent performance. Additionally, cybersecurity risks are included in the Audit Committee's risk oversight functions, which focus on operating and financial activities that could impact the companies' financial and other disclosure reporting. The Audit Committee's oversight involves reviewing and approving policies on risk assessment, controls, and accounting risk exposure. The Audit Committee also reviews internal audit reports regarding cybersecurity processes, and receives updates that focus on CMS Energy's and Consumers' cybersecurity program, mitigation of cybersecurity risks, and assessments by third-party experts. Of note, two members of the Board have extensive industry experience in cybersecurity and are on CMS Energy's and Consumers' Audit Committee.

companyName: CONSUMERS ENERGY CO

ticker: CMS-PB


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: (1) having an information security incident response plan for incident detection and response; (2) maintaining a disaster recovery plan, business continuity program, vulnerability management process and vendor risk management process; (3) conducting periodic risk assessments and employee training on cybersecurity; (4) maintaining security controls intended to address certain recognized industry cyber frameworks; (5) encrypting and segregating data, having network security controls, access controls and physical security, monitoring systems, managing assets (tracking and disposal) and conducting penetration testing; and (6) maintaining cybersecurity insurance.

companyName: NETGEAR, INC.

ticker: NTGR


text: Risk from Cybersecurity Treats We recognize that individual employees are frequent targets of threat actors. We regularly train employees on the importance of protecting our information, and communicate with our customers and employees on the importance to protect information and enhancing cybersecurity through security campaigns, newsletters, posters and ad-hoc communications. If specific threats are identified, management may communicate those threats directly to employees for heightened awareness. Our cybersecurity program requires employees to review and acknowledge information security and privacy policies annually, complete multiple cybersecurity training courses throughout the year, and participate in mock phishing campaigns regularly.

companyName: BYLINE BANCORP, INC.

ticker: BY


text: Our Vice President and Director of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Prior to his approximately 14 years overseeing and securing our information technology operations, our Vice President and Director of Information Technology held various roles during his approximately 9 years of tenure at USI New England, most recently overseeing and securing their information technology operations as Regional IT Manager. This experience is reinforced with regular cybersecurity training from industry leading organizations such as the SANS Institute and ISC2.

companyName: FRANKLIN STREET PROPERTIES CORP /MA/

ticker: FSP


text: The Company's Chief Information Security Officer, or CISO, leads the cybersecurity program and reports functionally to the Chief Legal Officer, and periodically to the CEO, the Executive Risk Management Committee, and the board of directors. The CISO has over 25 years of global cybersecurity, information security, disaster recovery, and business continuity experience, including leadership roles across UK national infrastructure and global Fortune 100 and 500 companies. The CISO holds an M.S. in Information Technology Security (with distinction), and is a Certified Information Security Manager, or CISM, and Certified Information Systems Security Professional, or CISSP.

companyName: 8X8 INC /DE/

ticker: EGHT


text: Management's Role in Managing Risk and Monitoring Incidents The leaders of our Information Security organization will be responsible for assessing and managing our material risks from cybersecurity threats and supervision of both our internal information security personnel and our retained external cybersecurity consultants.

companyName: Revelyst, Inc.


text: We continue to expand investments in IT security, including additional end-user security awareness training, using layered defenses, identifying and protecting critical systems, strengthening monitoring and alerting, and engaging experts as needed. We also use an industry standard risk quantification model to identify, measure, and prioritize cybersecurity risks. This in turn, helps us develop and implement effective security controls and technology defenses. In addition, all employees are required to complete various cybersecurity trainings on a regular basis. Further, we perform periodic simulations and tabletop exercises with the IT security team and will continue to expand its participants as appropriate. Our assessment of risks associated with the use of third party providers on a limited basis is part of our current overall cybersecurity risk management approach. As the threats and attacks are becoming more sophisticated, we will modify and enhance our cybersecurity program as needed.

companyName: DUCOMMUN INC /DE/

ticker: DCO


text: We are not aware of any material losses to our business or results of operations in the past three years due to information technology systems failures, data breaches, or other cybersecurity incidents.

companyName: LTC PROPERTIES INC

ticker: LTC


text: We use third -party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including, for example: a third -party IT and cybersecurity consultant; professional services firms, including legal counsel; threat intelligence service providers; cybersecurity software providers; managed cybersecurity service providers; penetration testing firms; dark web monitoring services; and forensic investigators.

companyName: UroGen Pharma Ltd.

ticker: URGN


text: We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to senior management and the Board, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: agilon health, inc.

ticker: AGL


text: Our management team, including our Chief Financial Officer, Chief Legal Officer and Chief Technology Officer, is responsible for assessing and managing our material risks from cybersecurity threats, and has primary responsibility for our overall cybersecurity risk management program. The management team has broad experience in overseeing and managing enterprise risk, governance and compliance functions, and supervises both our internal cybersecurity personnel, including our Senior Director of Cybersecurity who reports directly to our Chief Financial Officer, and external cybersecurity consultants retained from time to time, in each case who have broad cybersecurity experience and expertise, including in threat assessments and detection, mitigation technologies, training, incident response, cyber forensics, insider threats and regulatory compliance.

companyName: FuboTV Inc.

ticker: FUBO


text: Our cybersecurity program includes regular training for personnel, an incident response protocol tested at least annually as part of our enterprise-wide crisis response program, cybersecurity insurance, and regular assessments through activities such as penetration testing, and compliance audits performed on our information technology networks and systems by both our internal cybersecurity teams and external service providers.

companyName: Crane NXT, Co.

ticker: CXT


text: >on an ongoing basis for certain aspects of our information technology team's recurring monitoring and alert processes and round-the-clock support, as needed; and >periodically to perform penetration testing and vulnerability scanning of our systems, websites and properties, run or support tabletop exercises and complete cyber risk-based assessments of us.

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, like artificial intelligence platforms with an array of technologies, extensive encryption, firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. The Company's cybersecurity controls are incorporated into our internal control environment, managed and tested in accordance with the Sarbanes-Oxley Act.

companyName: WABASH NATIONAL Corp

ticker: WNC


text: Our cybersecurity risk management program is led by our Vice President of Information Security ("VP"), who manages our security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. Our program includes protocols for preventing, detecting and responding to cybersecurity incidents, and cross-functional coordination, and planning for business continuity and disaster recovery. We rely on our information security management system supported by a set of policies based upon industry frameworks, including the NIST Cybersecurity Framework. We have a Cyber Incident Response Team ("CIRT") in place to respond to, and prepare appropriate responses to cybersecurity threats or incidents. Components of our program include: • risk assessments designed to help identify and assess cybersecurity threats to our critical IT systems, information, and our broader enterprise IT environment; • monthly, mandatory cybersecurity awareness training for our employees, covering such topics such as phishing tactics, ransomware and developments in the current landscape of cyber-threats; • assessments of [and improvements to], among others, disaster recovery testing, access control, remote access, personnel security, system and communications protection, media protection, change management, data backup and recovery, audit logging, vulnerability and patch management, physical security, configuration management;

companyName: SCANSOURCE, INC.

ticker: SCSC


text: We have implemented a cybersecurity awareness program which covers topics such as phishing, social networking safety, password security and mobile device usage. We have mandatory training in the areas of cybersecurity, privacy and confidential information handling. We also conduct regular phishing training and simulations for our employees and contractors. We provide extensive specialized role-based training to technical professionals in cybersecurity, secure application development and other focus areas. We also conduct periodic tabletop exercises to validate our preparation for cyber events.

companyName: CATERPILLAR FINANCIAL SERVICES CORP


text: ALLETE faces a number of cybersecurity risks in connection with its business. Although such risks have not materially affected us, including our business strategy, results of operations, and financial conditions, to date, we have, from time to time, experienced threats to and breaches of our data systems, including malware, phishing and computer virus attacks. See Item 1A. Risk Factors for additional information regarding our organization's cybersecurity risks, which should be read together with this Item 1C. Cybersecurity.

companyName: ALLETE INC

ticker: ALE


text: Our Information Security Officer provides quarterly briefings to the Audit Committee regarding our cybersecurity risks and activities, including our progress on mitigating threats identified by external cybersecurity risk audits, any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like, in each case as applicable. Our Audit Committee provides regular updates to the board of directors on such reports.

companyName: Blend Labs, Inc.

ticker: BLND


text: Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining our business continuity plans, IT security policies and procedures, and providing regular reports to our board of directors, including through the Audit Committee. Our IT consultant monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of software tools, and regularly reports to management.

companyName: FRP HOLDINGS, INC.

ticker: FRPH


text: Our Chief Financial Officer and Chief Operating Officer are jointly responsible for managing cybersecurity risks and implementing the required policies across the Company. Our Chief Executive Officer is responsible for making strategic decisions and approving external communication releases related to cybersecurity risks or incidents.

companyName: Applied Therapeutics, Inc.

ticker: APLT


text: We maintain policies regarding our information security practices, including an incident response plan to coordinate response and mitigation efforts in the event we experience a cybersecurity incident. These policies require notification of cybersecurity incidents to our information security team, and if warranted based on the perceived level of severity of the incident, to members of our executive leadership. We have not identified any cybersecurity incidents or threats that have materially affected us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please consult "ITEM 1A. RISK FACTORS".

companyName: AlTi Global, Inc.

ticker: ALTI


text: In addition, our entire management team is actively engaged in assessing and managing material risks from cybersecurity threats. We have established a robust framework for identifying, preventing, mitigating, and remediating such risks. We have an extensive and experienced team responsible for cybersecurity risk management.

companyName: INDEPENDENT BANK CORP /MI/

ticker: IBCP


text: United States based operations nor European based operations sells directly to retail consumers, which diminishes to some degree, but does not preclude, the likelihood of third party access to our data.

companyName: INTERPARFUMS INC

ticker: IPAR


text: As part of the above processes, we regularly collaborate with third-party entities to enhance and fortify our cybersecurity risk management program, including through internal and external penetration testing and cybersecurity awareness training. As needed, we require third party service providers to adhere to certain cybersecurity standards and processes and agree to be subject to cybersecurity audits.

companyName: DOC DR Holdco, LLC


text: We regularly engage third-party assessors, consultants, and auditors to test and evaluate our controls for managing cybersecurity threats. These include third-party engagements by management and by our Internal Audit Department for (i) regular penetration testing of our cyber defenses, including an annual PCI-certified penetration test, (ii) third-party "health checks" on supporting technology, including our security incident and event management system (SIEM) and vulnerability management program, and (iii) third-party social engineering tests of the effectiveness of our employee training for detection of invasive attempts by malevolent actors. In addition, the Federal Reserve and DFI examine our control environment for managing cybersecurity risks each year.

companyName: 1ST SOURCE CORP

ticker: SRCE


text: Wiley is committed to maintaining robust cybersecurity practices to safeguard our operations, data, and stakeholders' interests. We monitor our cybersecurity landscape and adapt our strategies and governance practices to mitigate risks in this rapidly evolving area.

companyName: JOHN WILEY & SONS, INC.

ticker: WLY


text: Strategy and Processes We maintain a cybersecurity program to help us assess, identify, and manage cybersecurity risks to our systems and data, including to help us defend against and mitigate emerging and existing cybersecurity threats to our information technology and operational technology systems. Our strategies and processes for managing cybersecurity risks are informed by relevant industry frameworks and laws, regulations and standards applicable to us in the jurisdictions in which we do business, including those applicable to utilities that operate bulk electric systems or critical pipeline facilities. We maintain various policies, procedures, technologies and other controls to help prevent, detect, mitigate and manage cybersecurity threats and incidents. We also use third-party consultants and service providers to support our risk management efforts, such as services for cybersecurity intelligence, monitoring, testing and assessments.

companyName: CENTERPOINT ENERGY RESOURCES CORP


text: At Aviat, cybersecurity processes, controls and technologies have been implemented to help facilitate the Company's efforts to identify, assess and manage material risks associated with cybersecurity threats.

companyName: AVIAT NETWORKS, INC.

ticker: AVNW


text: In addition, the Enterprise Risk Committee, a committee of senior executives who identify and monitor the risks to PPG and are responsible for our ERM program, receives updated information on cybersecurity risks at each of its meetings.

companyName: PPG INDUSTRIES INC

ticker: PPG


text: As an HCM company, we face a multitude of cybersecurity threats from threat actors seeking to access or leverage the data we possess for malicious ends. Review of our information security program, including our cybersecurity policies, standards, and processes, is integrated into our Enterprise Risk Management ("ERM") program which is based on the COSO Enterprise Risk Management Framework and International Organization for Standardization ("ISO") 31000, the two most widely used global standards for ERM.

companyName: Dayforce, Inc.

ticker: DAY


text: Members of management work collaboratively to develop and implement policies, practices and procedures to protect our IT networks and related systems from cybersecurity threats and to respond appropriately and timely to any cybersecurity incidents. The members of management responsible for our cybersecurity risk management program include our Vice President–Information Technology, our Chief Financial Officer, our General Counsel, our Chief Accounting Officer, our Head of Data, Analytics and Technology, and our Vice President–Financial Reporting and Accounting. Through ongoing communications from employees in each of our Data, Analytics and Technology and Information Technology departments, such members of management monitor our assessment of material cybersecurity risks, our prevention and detection of cybersecurity threats, and, if a cybersecurity incident were to occur, our mitigation and remediation of such incident.

companyName: STAG Industrial, Inc.

ticker: STAG


text: At the management level, the Enterprise Risk Management Committee ("ERMC") is primarily responsible for cybersecurity risk management. As it pertains to the information security program, the ERMC assesses and monitors information security risks and approves the information security policy on at least an annual basis. Certain instances of non-compliance with the information security policy are escalated to the EMRC, which may further escalate to the TOC as appropriate. Once escalated to a committee, the committee is responsible for overseeing related remediation.

companyName: EAGLE BANCORP INC

ticker: EGBN


text: Engaging Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we regularly engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights in order to adhere to industry standard practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: WORKIVA INC

ticker: WK


text: Our IT Systems Administrator is responsible for assessing and managing our risks from cybersecurity threats and oversees our cybersecurity program. The IT Systems Administrator reports directly to our CFO. Our IT Systems Administrator holds an associate degree in computer application and support and has served in various roles in information systems administration for over eight years, including roles involving managing information technology and systems and implementing cybersecurity programs.

companyName: PERPETUA RESOURCES CORP.

ticker: PPTA


text: Management's Role Managing Risk Aveanna's cybersecurity program and related policies are managed by a dedicated Assistant Vice President ("AVP") of Cybersecurity who reports to our Chief Information Officer ("CIO"). The AVP of Cybersecurity and his team is responsible for assessing, identifying and managing enterprise-wide cybersecurity needs. The AVP of Cybersecurity and his team monitor breach attempts and other cyber-related incidents, both directed at the Company and those impacting other industry participants, to identify new and emerging risks to be added to our Vulnerability Management Framework, which is discussed below.

companyName: Aveanna Healthcare Holdings, Inc.

ticker: AVAH


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors in this Annual Report on Form 10-K, including "Risk Factors – If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."

companyName: MANNKIND CORP

ticker: MNKD


text: While we, our business partners and affiliates, and our vendors and service providers are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate of related occurrences, have had a material impact on our service, systems, business, financial condition, or results of operation of our business in the period covered by this report. In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost client revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services, client dissatisfaction, and loss of investor confidence. Any significant disruption to our service or access to our systems could adversely affect our business, results of operation and reputation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information or other sensitive information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition, and results of operations. See "Risk Factors – Cybersecurity." Any significant disruption or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cybersecurity incidents or attacks, could result in a loss or degradation of service, unauthorized disclosure of data, including corporation information, or theft of intellectual property, including digital content assets, which could adversely impact our business."

companyName: 5&2 Studios, Inc.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a risk management process for certain third-party service providers, suppliers, and vendors based on, among other things, their criticality to our operations, access to RTR data, cybersecurity risk profile, and business requirements.

companyName: Rent the Runway, Inc.

ticker: RENT


text: Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks and have developed our own practices and framework, which we believe enhance our ability to identify and manage cybersecurity risks. Our Audit Committee oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. The IT Risk Committee and our cybersecurity consultant, which has extensive information technology and program management experience, regularly brief the Audit Committee on our cybersecurity and information security posture and the Audit Committee is apprised of any cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The Audit Committee retains oversight of cybersecurity because of its importance. In the event of any incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Audit Committee, as appropriate.

companyName: VivoSim Labs, INC.

ticker: VIVS


text: We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. As discussed in more detail under "Cybersecurity Governance" below, our board of directors and our audit committee provide oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Compliance Officer, Chief Administrative Officer, Chief Operating Officer, Security Officer, Data Protection Officer, Senior Director of Cybersecurity and IT, and Governance Risk and Compliance Manager.

companyName: Hyperfine, Inc.

ticker: HYPR


text: With respect to third party service providers, Cheniere's information security program includes conducting risk-based due diligence of certain service providers' information security programs prior to onboarding. Cheniere seeks to contractually require third party service providers with access to our information technology systems, sensitive business data or personal information to maintain reasonable security controls and restrict their ability to use Cheniere's data, including personal information, for purposes other than to provide services to us, except as required by applicable law. Cheniere also seeks to negotiate contractual requirements which compel our service providers to notify us of information security incidents occurring on their systems which may affect Cheniere's systems or data, including personal information.

companyName: Cheniere Energy Partners, L.P.

ticker: CQP


text: The Audit Committee of our Board oversees our risk management process, which includes risks from cybersecurity threats. The Audit Committee receives reports from management at least semi-annually, and more frequently if necessary, with respect to risks from cybersecurity threats. The Audit Committee also reviews cybersecurity and data security risks and mitigation strategies, along with program assessments, planned improvements and the status of information technology initiatives.

companyName: Vericel Corp

ticker: VCEL


text: Risk Identification and Management The Company has a cybersecurity Risk Management Policy in place that governs the life cycle in which cybersecurity risks, including: • Risk Identification: through various initiatives performed, including, annual assessments, penetration tests, Incident Response tabletop exercises, vulnerability scans, system monitoring activities, and cybersecurity reviews of critical third-party vendor engagements, etc. • Risk Evaluation & Treatment: Identified issues, vulnerabilities, and exposures are captured within the Company's Risk Register, which is updated periodically to reflect the most up to date treatment option selected by the Risk Owners. • Risk Reporting and Ongoing Management: Potentially material risks are shared as part of a monthly Cybersecurity Governance Forum, that's attended by leadership. Risk Mitigations are tracked to completion through various project updates.

companyName: Drilling Tools International Corp

ticker: DTI


text: One of the primary responsibilities of the Technology Committee is to review reports submitted by the Chief Information Security Officer (the "CISO") of the Company, the Company's Chief Digital Officer (the "CDO"), the CRO, and other officers or employees regarding cybersecurity threats and incidents in order to assist in coordinating prevention and mitigation efforts. In addition, the Technology Committee conducts an annual review of its own performance and the Company's cybersecurity-related expenditures to identify areas for potential improvement that could benefit the cybersecurity program of the Company.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: In fiscal year 2025, we achieved our primary cybersecurity risk management objective of having no material cybersecurity incidents. Over the past three years, we have not experienced any material information security breaches and have not incurred material expenses from cybersecurity incidents, including those arising at third parties.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: As part of our cybersecurity risk management program, we maintain industry standard procedures and policies, which are reviewed and revised periodically, and certified to comply with ISO 27001 standards, to both proactively assess, identify and manage potential cybersecurity risks and respond to any actual cybersecurity threats and incidents. Such procedures and policies include: actively monitoring our information technology systems to ensure compliance with applicable legal and regulatory requirements; engaging third-party consultants and other service providers to monitor and, as appropriate, respond to cybersecurity risks; requiring our service providers and our business partners who connect directly to our information technology systems to comply with our cybersecurity standards and due diligence processes and be subject to our non-disclosure and other confidentiality agreements that include cybersecurity-related terms; providing and analyzing specialized industry sector intelligence on cybersecurity threats; regularly testing our cybersecurity systems and disaster preparedness, including our back-up information technology systems; developing and updating incident response plans to address potential cybersecurity threats; and maintaining and training our personnel on cybersecurity incident reporting procedures. Teva engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to obtain current threat intelligence, collaborate on security enhancements, and evaluate and improve the effectiveness of its information security program.

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA


text: We have an Executive Cybersecurity Steering Committee that is facilitated by our CISO, which is designed to engage business leadership and employ best practices, including ongoing enhancements to governance, risk and compliance. Our internal audit function also performs independent testing on aspects of the operations of our cybersecurity program and the supporting controls based upon its risk-based internal audit plan and reports the results of these audits in its periodic reports to the Audit Committee. Our CISO currently reports to our Chief Information and Digital Officer and is responsible for training and leading a dedicated information security team tasked with protecting data and preventing, identifying, and appropriately addressing cybersecurity threats. The CISO is a Certified Information Systems Security Professional with over 20 years of experience developing and maturing information security programs, including experience with leading privacy, enterprise risk, records management, business continuity and operational risk programs, among others.

companyName: MCCORMICK & CO INC

ticker: MKC


text: Our Company's Chief Information Officer (CIO) is responsible for developing and maintaining our global cybersecurity and information technology program and directs our Information Security team. The Information Security team is primarily responsible for identifying and protecting against cybersecurity threats and maintains a comprehensive set of policies and standards applicable to our global organization. We consult with multiple third-party firms to assess and review these policies and standards and regularly update them for contemporary best practices. Our CIO has over fifteen years of experience leading cybersecurity oversight for global organizations, and our Information Security team leaders have extensive cybersecurity and information technology industry experience with Olin or other large public companies and hold industry certifications, including the Certified Information Systems Security Professional certification.

companyName: OLIN Corp

ticker: OLN


text: To date, no cybersecurity incident has resulted in any material impact on our business, operations or financial results or our ability to service our customers or run our business. We maintain insurance coverage designed to mitigate our exposure to network security and privacy matters. Refer to Item 1A Risk Factors for additional discussion of risks associated with cybersecurity threats to the Company.

companyName: XEROX CORP


text: The Company has an established cybersecurity and information security awareness training program that includes mandatory annual training and regular communications for our employees regarding cybersecurity threats and methods of mitigation.

companyName: BUTLER NATIONAL CORP

ticker: BUKS


text: As of the date of this filing, we are not aware of any current cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For further discussion of the risks related to cybersecurity, see Item 1A. Risk Factors.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: As part of our broader approach to risk management, our cybersecurity program is designed to follow an "identify, protect, detect, respond and recover" approach to cybersecurity that is based off of the National Institute of Standards and Technology Cybersecurity Framework ("CSF"). Our strategy also includes segmentation of corporate and operations networks, defense in depth and the least privileged access principle. Operational networks have fundamentally distinct safety and reliability standards and pose unique threats in comparison to information technology networks. Realizing these differences, we routinely evaluate opportunities to refine our cybersecurity program in order to mitigate operational network risks. We include business continuity planning as a component of our strategy to help ensure critical systems are available to support the Partnership in the instance of a disruptive event. We also participate in various industry organizations to stay abreast of recent trends and developments.


text: Our CTO and CISO lead our Cybersecurity Incident Response Plan management of cybersecurity incidents with a cross-functional team to assess the potential materiality of cybersecurity events and to report on the detection, analysis, containment and eradication of and recovery from such events. If the severity of events meet certain criteria, as specified by the Incident Response Plan, those events are escalated to senior levels of management and reported to our Disclosure Committee and the Audit Committee. Our Disclosure Committee is responsible for the oversight of controls and procedures related to the public disclosure of material cybersecurity incidents.

companyName: STEELCASE INC


text: Board of Trustees Oversight The audit committee of our board of trustees is central to the board of trustees's oversight of cybersecurity risks and bears the primary responsibility for this domain. The members of the audit committee have a variety of expertise, including financial, regulatory and risk management. The audit committee reviews our policies with respect to risk assessment and risk management related to cybersecurity. The audit committee and the board of trustees receive updates on the Company's cybersecurity risks and initiatives periodically. In addition, cybersecurity matters are reported to the audit committee or board of trustees so that the board of trustees and audit committee can effectively carry out their oversight role.

companyName: National Storage Affiliates Trust

ticker: NSA


text: From time to time, we engage third-party service providers, including professional services firms, threat intelligence services, cybersecurity consultants, penetration testing firms, and forensic investigators, to assist with identifying, assessing, and managing cybersecurity risks.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining an incident response plan, a vulnerability management policy, disaster recovery and business continuity plans and a vendor risk management program; conducting employee training, systems monitoring and penetration testing; implementing security standards, network security controls, access controls and physical security; encrypting and segregating data; though asset management, tracking and disposal; and maintaining cybersecurity insurance.

companyName: CYTOKINETICS INC

ticker: CYTK


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program and the IT Department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Tectonic Therapeutic, Inc.

ticker: TECX


text: We focus on further building cybersecurity resiliency throughout our value chain. We perform risk management via an industry third-party risk management service provider for all critical vendors, partners, and systems (including third-party hosted information systems) meeting our risk management policy criteria, to minimize the likelihood and impact of malicious cybersecurity incidents. During the onboarding phase, our cybersecurity team under the direction of the Sr. Director Information Security, Compliance, and Privacy, performs a technological risk assessment on, and utilizes certain tools to detect external risk posed by, the vendor, partner and/or system. Vendors identified as posing elevated risk are escalated to senior management for informed risk tolerance determination. Following the onboarding phase, the cybersecurity team continuously monitors risks related to the vendor, partner and/or system. All third-party cybersecurity incidents are tracked though the third-party service provider and are communicated to our cybersecurity team upon discovery. We prioritize our mitigation of cybersecurity risks based on relative severity (e.g., critical risk, high risk, low risk) and document a mitigation plan that details a resolution timeline.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: With respect to third party service providers, Key maintains a third party management program that is designed to identify, review, monitor, escalate, and, if necessary, remediate third party information security risks. Key's third party onboarding process includes risk-based due diligence and security-relevant contract language. Risk-based due diligence can also include an assessment of the strength of certain control areas, including, but not limited to, information security management, physical security, network security, platform security, application security, cloud security, encryption management, business resiliency, and privacy. Once a business relationship is established with a service provider, Key performs risk-based periodic reviews of the third party service provider's security programs. In addition to an established governance approval process for new engagements, Key has established a Third Party Management Committee to oversee compliance with Key's Third Party Management Policy and Program.

companyName: KEYCORP /NEW/

ticker: KEY


text: Our commitment to cybersecurity extends beyond our internal operations. We work closely with trusted third-party vendors and partners to ensure that they also meet our rigorous security standards. We utilize third-party cloud computing services as part of our global business operations. We also employ the use of third-party content delivery networks (CDN) to help us stream content in high volume to our members over the internet. Problems faced by Gaia or any of our third-party cloud computing or other network providers, involving technological or business-related disruptions, as well as cybersecurity threats, may have an adverse impact on the member experience.

companyName: GAIA, INC

ticker: GAIA


text: Our information security team is led by our Chief Information Security Officer and is comprised of dedicated professionals responsible for overseeing cybersecurity risk management and mitigation, incident prevention, detection and remediation. These teams are spearheaded by professionals with decades of cybersecurity leadership experience across multiple industries, including our Chief Technology Officer. Our leadership working group meets on a weekly basis to discuss our approach to the rapidly-evolving cybersecurity landscape. To ensure that our top-level strategy is disseminated throughout the Company, our information security team provides hands-on and often role-specific training and awareness programs to our employees. Our employees with network access participate annually in required training, including spear phishing and other awareness training. We also periodically conduct simulated phishing exercises to practice appropriate response and augment employee awareness of established and emerging cyber threats.

companyName: Core Scientific, Inc./tx

ticker: CORZ


text: When identified by management, cybersecurity threats are to be immediately reported to Arvana's Audit Committee. The Audit Committee has primary responsibility for oversight of cybersecurity threats once a cybersecurity threat has been reported to it by management. Matters to be considered by the Audit Committee include management risks relating to data privacy, technology, and information security.

companyName: ARVANA INC

ticker: AVNI


text: We detect frequent attempts by third parties to gain access to our systems and networks, and the frequency of such attempts could increase in the future. As of the date of the filing of this Form 10-K, we are not aware of and do not believe that any such attempts that have occurred since the beginning of 2024 that have had a material effect, or are reasonably likely to have a material effect, on our business, operations, or financial condition. However, there can be no assurance that our protection efforts will be successful. See "Risks Relating to Our Business and Operations – A cybersecurity incident impacting customer, employee, supplier, or Company information, or Company systems or infrastructure, may have a material adverse effect on our business, financial condition, and results of operations." in "Risk Factors" on page 10 of this Form 10-K.

companyName: MATERION Corp

ticker: MTRN


text: Our cybersecurity operations team manages all facets of cybersecurity monitoring, coordinating with managed services security providers and internal analysts across the Company. All employees are provided cybersecurity awareness training, which includes topics on our policies and procedures for reporting potential incidents. Our cybersecurity team regularly evaluates emerging risks, regulations, and compliance matters and updates applicable policies and procedures accordingly.

companyName: Global Business Travel Group, Inc.

ticker: GBTG


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: 10x Genomics, Inc.

ticker: TXG


text: As a general matter, our CDO is responsible for defining our entire cybersecurity posture. The CDO has oversight in planning the strategy, programs, policies, and procedures to protect the organization's digital assets, information, and infrastructure. Our IT Director, Cyber Security serves as the CIMT's Incident Manager and is the member of management primarily responsible for assessing, identifying, mitigating, and managing cybersecurity risks; supervising IT security design, development, implementation, and testing; and running the day-to-day operations of our cybersecurity team. Our CDO holds a bachelor's degree in electronics and telecommunications engineering and has more than 35 years of information technology and cybersecurity experience in various leadership and executive roles. In addition, our IT Director, Cyber Security holds a bachelor's degree in computer information systems and the Certified Information Systems Security Professional (CISSP) and Information Systems Security Architecture Professional (ISSAP) certifications, as well as over 30 years of experience as an information technology professional with the most recent 15 years specializing in cybersecurity.

companyName: BWX Technologies, Inc.

ticker: BWXT


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: External resources: Tyler leverages third-party assessments, audits, and reporting obligations to provide additional layers of accountability, monitoring and testing. This includes a bug reporting program that we publish that invites any third party to report a security vulnerability they have identified. We also use a Qualified Security Assessor to perform an annual Payment Card Industry Data Security Standards assessment that tests our credit card data controls, and we undergo an annual System & Organizational Control audit to generate a report of our key compliance controls and objectives, among other things. Given our technology in the courts and public safety markets, we also manage compliance with Criminal Justice Information Systems security standards that are established by the Federal Bureau of Investigation ("FBI"), and we partner with our clients and third-party Criminal Justice Information Services ("CJIS") compliance consultants to ensure that we adhere to the requirements applicable to us.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: While the full board of directors has overall responsibility for risk oversight, for cyber security matters, it is supported by its Audit Committee, which regularly reports to the full board of directors. The Audit Committee assists the board of directors in monitoring cybersecurity risk by receiving quarterly reports and as needed updates from the Chief Information Officer and the CISO, that cover, among other things, our information security framework, threat assessment, response readiness and training efforts.

companyName: Hilton Worldwide Holdings Inc.

ticker: HLT


text: We maintain a Cybersecurity Incident Response Plan, based on NIST's incident handling framework, to guide our response to cybersecurity threats. The plan includes procedures to triage, assess severity and remediate events in our information technology infrastructure. Annually, we engage third-party experts to conduct penetration testing inside our network.

companyName: STEELCASE INC


text: Our cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. • Incident Response and Recovery Planning: We are establishing incident response, business continuity, and disaster recovery plans designed to address our response to a cybersecurity incident. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. • Periodic Assessments: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are evaluated by management and reported to our Audit Committee and our board of directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: SOLENO THERAPEUTICS INC

ticker: SLNO


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face.

companyName: CalEthos, Inc.

ticker: GEDC


text: In addition, the IT Service Provider and Angel Oak Capital have established a notification and escalation framework, based on the severity of a cybersecurity threat or incident, to determine when and to whom the IT Service Provider will provide notifications regarding cybersecurity threats or incidents. The framework includes notification to the Head of IT. Depending on their nature, incidents may also be reported to members of our management, the Audit Committee of our Board of Directors and to our full Board of Directors, as appropriate. In addition to its engagement of the IT Service Provider, we and/or Angel Oak Capital may engage other third parties, including auditors and consultants, to perform assessments or audits of our and/or its cybersecurity policies and procedures and/or to assist with the evaluation of a cybersecurity threat or incident, among other matters.

companyName: Angel Oak Mortgage REIT, Inc.

ticker: AOMR


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties, including having a third-party independent qualified and accredited advisor review our cybersecurity program to help identify areas for continued focus, improvement and compliance.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: Our senior executive leadership is actively engaged in the oversight and strategic direction of our cybersecurity and digital data protection programs. The senior executive leadership-level Cybersecurity Steering Committee ("CSC") is responsible for assessing cybersecurity risks, providing direction and oversight for risk mitigation action, and assisting the Audit Committee in overseeing the Company's cybersecurity risks. The CSC also receives monthly reports on the Company's cybersecurity program and developments from our CISO and legal representatives. The CSC is chaired by our CISO. The senior executive leadership members include the CIO, Chief Legal Officer, Chief Financial Officer, Chief Compliance Officer, and Senior Vice President, Enterprise Operational Excellence.

companyName: Baker Hughes Co

ticker: BKR


text: The Audit and Risk Committee of the Board of Directors has oversight of cybersecurity risk and receives briefings on a quarterly basis. The briefings are provided either by the cybersecurity team, together with a senior member of management, or are presented as part of the Audit and Risk Committee's regular review of top enterprise risks, in which cybersecurity risk is reviewed annually or more frequently if circumstances warrant. The Audit and Risk Committee briefs the full Board of Directors at each meeting. In addition, the full Board of Directors has participated in cybersecurity exercises. The Audit and Risk Committee is also provided with information about external assessment results and action plans. There is a process in place to notify the Audit and Risk Committee promptly in the event of a material cybersecurity incident.

companyName: PORTLAND GENERAL ELECTRIC CO /OR/

ticker: POR


text: BlackRock ' s Cybersecurity Governance BlackRock's Board is actively engaged in the oversight of BlackRock's risk management program. BlackRock's Risk Committee assists BlackRock's Board with its oversight of BlackRock's levels of risk, risk assessment, risk management and related policies and processes, including risks arising from cybersecurity threats. BlackRock's Risk Committee receives regular reports on BlackRock's cybersecurity program, technology resilience risk management and related developments from members of our information security team, including the CISO. BlackRock's Board and BlackRock's Risk Committee also receive information regarding cybersecurity incidents that meet certain reporting thresholds. On an annual basis, senior members of BlackRock's technology, risk and information security teams provide a comprehensive overview of BlackRock's cyber risk and related programs to a joint session of BlackRock's Board's Risk and Audit Committees.

companyName: ISHARES GOLD TRUST

ticker: IAU


text: By outsourcing certain business and administrative functions to third parties, we may be exposed to an enhanced risk of data security breaches. Any breach of data security could damage our reputation and/or result in monetary damages, which, in turn, could have a material adverse effect on the Company's results of operations, liquidity and financial condition.

companyName: Unique Logistics International, Inc.


text: Management evaluates cyber incidents based on their materiality, considering factors such as: • Financial impact: Potential losses in revenue, profits, or assets. • Reputational damage: Impact on our brand image and customer trust. • Regulatory compliance concerns: Potential violations of data privacy regulations or other legal requirements. • Operational disruption: Impact on business continuity and ability to deliver services.

companyName: FORWARD AIR CORP

ticker: FWRD


text: Our ability to effectively manage our business, coordinate the production, distribution and sale of our products and ensure the timely and accurate recording and disclosure of financial information depends significantly on the reliability and capacity of our information technology systems. While we have taken what we believe are appropriate precautions to protect our systems, and to date, we have not experienced any material adverse events related to a security breach or cyber-attack, the failure of these systems to operate effectively, the failure of our personnel to follow established procedures, problems with transitioning to upgraded or replacement systems, or a breach in security of these systems through a cyber-attack or otherwise could cause delays and/or interruptions in plant operations, product sales, reduced efficiency of our operations and delays in reporting our financial results.

companyName: REX AMERICAN RESOURCES Corp

ticker: REX


text: Board Oversight of Cybersecurity Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Extra Space Storage Inc.

ticker: EXR


text: During the period covered by this report, risks from cybersecurity threats did not have a material impact on our strategy, results of operations, or financial condition. We have experienced cybersecurity incidents in the past, though none have had a material effect on our financial condition or results of operations.

companyName: Federal Home Loan Bank of Topeka


text: We maintain a technology and cybersecurity program, which includes information security, as part of our overall risk management process with the aim that our information systems, including those of our vendors and other third-parties, will be resilient, effective, and capable of safeguarding against emerging risks and cybersecurity threats. A key element of our technology and cybersecurity program strategy is fostering training and awareness for our employees.

companyName: Cardiff Lexington Corp

ticker: CDIX


text: We rely upon internally and externally managed information technology systems for the collection and storage of sensitive data and business information. We approach cybersecurity risks with a risk management and governance strategy designed to assess, identify, and manage cybersecurity risks to our business.

companyName: Hawkeye Systems, Inc.

ticker: HWKE


text: Our ECS team is led by our CISO. Our CISO reports to our CIO who, in turn, reports to our Executive Vice President and Chief Financial Officer. Our CISO has 24 years of experience in leading global security functions and strategies. Collectively, the other members of our ECS team have decades of relevant education and experience and maintain a wide range of industry certifications. We invest in regular, ongoing cybersecurity training for our ECS team.

companyName: ON SEMICONDUCTOR CORP

ticker: ON


text: The Board of Directors has specifically delegated oversight of the Company's cybersecurity risks and related practices to the Audit Committee of the Board of Directors (the "Audit Committee") through the committee's charter. At least annually, senior members of the Company's information technology team (including the Chief Technology Officer) and internal audit services team brief the Audit Committee on information and cyber security matters, including results from risk assessments, the Company's policies and its internal control function. The Audit Committee reviews such information alongside other company risks as part of our overall risk assessment.

companyName: Curbline Properties Corp.

ticker: CURB


text: Sensitive and confidential data are an essential part of our business. We leverage a cybersecurity policy that identifies the type of information we store and what level of encryption and access role entitlement is required to store and access the data. This document also details the overarching requirements for encryption, such as encryption methods, and secret/key storage and retention. These requirements are periodically reviewed to ensure continued alignment with industry standards and regulatory expectations.

companyName: USBC, Inc.

ticker: USBC


text: Reporting to Board of Directors The SVP Technology plays a pivotal role in informing the Audit Committee on cybersecurity-related risks. The Audit Committee holds quarterly meetings and the SVP Technology provides periodic reports, on at least a quarterly basis, to the Audit Committee.

companyName: TANGER PROPERTIES LTD PARTNERSHIP /NC/


text: Our Board of Directors oversees the execution of our cybersecurity strategy and the assessment of cybersecurity risks, along with the actions that we may take to mitigate and address those cybersecurity risks. Our Vice President of Information Technology ("VP of IT") who has over 30 years of experience in technology leads our cybersecurity initiatives and oversees a team of professionals responsible for executing and managing our cybersecurity program. This program emphasizes proactive prevention, detection, mitigation and remediation of potential cybersecurity incidents. To maintain transparency and facilitate informed decision making, our VP of IT and cybersecurity team provide periodic updates on the status of cybersecurity risks and initiatives. These updates are communicated to the Board of Directors, in order to ensure that they remain informed about our cybersecurity posture. By promoting collaboration among our Board of Directors, executive leadership and cybersecurity experts, we are committed to protecting our digital assets and fostering stakeholder trust. Our continuous efforts to enhance our cybersecurity framework enable Twin Hospitality Group Inc. to effectively respond to the evolving threat landscape.

companyName: Twin Hospitality Group Inc.

ticker: TWNPQ


text: Our ISO reports directly to, and meets periodically with, our Chief Financial Officer (CFO) to discuss and review our cybersecurity risk management processes, including our cybersecurity metrics, with input from the Company's MSSP and other third-party providers and cybersecurity consultants, as appropriate. Our ISO also works closely with our Chief Compliance Officer (CCO) in the establishment and management of controls and processes that underpin our cybersecurity risk management program and meets periodically with our entire executive management team, including our Chief Executive Officer, regarding cybersecurity threats and our cybersecurity risk management program. We have implemented a process for the ISO to report relevant findings from penetration testing and cybersecurity assessments conducted by third-party consultants to members of our management team, including our CFO and CCO, as appropriate.

companyName: Vigil Neuroscience, Inc.


text: As part of our cybersecurity program, we employ a range of security mechanisms and controls throughout our technology environment, which include the use of tools and techniques to search for cybersecurity threats and vulnerabilities, as well as processes designed to address such threats and vulnerabilities. We also engage a number of external service providers with additional knowledge and capabilities in cybersecurity threat intelligence, detection, and response. In addition, a range of cyber educational initiatives are employed to promote best practices for protecting our information and data, and reporting cyber threats and other risks to corporate systems, data, and facilities.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: Incident Identification and Response We have implemented a monitoring and detection system to help identify cybersecurity incidents. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate. Cybersecurity Training and Awareness All employees are required to receive annual cybersecurity awareness training.

companyName: Sitio Royalties Corp.


text: Our Senior Information Security Officer ("SISO"), who is supported by a team of specialized Information Security and Third-Party Risk Management Analysts, is primarily responsible for the development, oversight, and administration of our Information Security, Business Continuity, and Vendor Risk Management Programs. The SISO has over 25 years of experience in information security, information technology, and enterprise risk management and holds certifications as both a Certified Information Systems Security Professional ("CISSP") and Certified Information Systems Auditor ("CISA"). The SISO is an active member of the following management-level committees: Incident Response Committee, IT Steering Committee, Change Control Committee, Product Management Committee, Project Management Committee, and Operational Risk Management Committee ("ORMC"). The SISO reports to the ORMC on a quarterly basis, or more frequently if needed, regarding the effectiveness and status of the cybersecurity program, material cybersecurity risks and key risk indicators, and material cybersecurity trends and developments.

companyName: Hanover Bancorp, Inc. /MD

ticker: HNVR


text: Caterpillar's cybersecurity program is overseen by the Caterpillar CIO, who has been a Caterpillar employee for nearly 25 years. Prior to her current appointment as Caterpillar's CIO in September 2020, she was the Chief Information Officer for the Caterpillar's Financial Products Division, which includes Cat Financial. Her extensive background in IT includes global leadership for large-scale systems transformations, cybersecurity, cloud and application management, global data center management, worldwide network, servers and storage, database management and end-user services. The Caterpillar CIO leads a cross-functional cybersecurity team comprised of professionals from Caterpillar's product, cybersecurity, legal and compliance organizations who focus on managing the security of Caterpillar's connected solutions. This team manages the Caterpillar's global IT systems, IT risk management, cybersecurity, global infrastructure and IT transformations.

companyName: CATERPILLAR FINANCIAL SERVICES CORP


text: The energy sector, including electric and natural gas utility companies, has become the subject of cyberattacks with increased frequency and we, along with other utility companies, are the target of these frequent attacks. In addition, there is a growing reliance on third party providers which are also subject to attacks and breaches. Any unexpected failure, or unauthorized access to technology systems or third parties relied upon can result in the unavailability of systems or services, which can result in a loss of operating revenues, damage to our brand and reputation, and/or an increase in operating expenses and costs to repair or replace damaged assets. See "Risk Factors – Cyber Risk Factors" for further information.

companyName: AVISTA CORP

ticker: AVA


text: Cybersecurity incidents that are deemed Priority 1 (described in the Incident Response Plan as those incidents affecting key operational and financial systems), are reported to certain members of the Company's Executive Leadership Team including the Chief Executive Officer, Chief Financial Officer, General Counsel and Chief Information Officer ("CIO") for assessment of the materiality of the incident, which will be made using both quantitative and qualitative analysis to determine an incident's immediate and reasonably likely future impacts. Cybersecurity incidents that are deemed material, either individually or in aggregate, are reported to the Audit Committee of the Company's Board of Directors, which has been delegated the responsibility for oversight of cybersecurity risks. The Company also communicates material cybersecurity incidents to the Company's independent auditors and internal audit team.

companyName: GRAPHIC PACKAGING HOLDING CO

ticker: GPK