text: The Company's Information Security team is responsible for the Company's cybersecurity risk management program. Their Information Security policies contain processes and templates which are intended to set standards, assign specific roles and responsibilities with respect to our information security environment, and categorize threats and map them to responses as required by law and contract.

companyName: QUINSTREET, INC

ticker: QNST


text: • Understanding evolving threats in the industry and with our suppliers. Our cybersecurity and data privacy teams work to understand evolving threats, developing issues, and industry trends, and our vendor teams monitor and assess risks with our suppliers. • Collaboration with organizations across different industries. We share threat intelligence and collaborate with organizations across different industries to share best practices, fight cybercrime, enhance privacy, discuss new technologies, better understand the evolving regulatory environment, and advance capabilities in these areas. • Investment, training, and development of our cybersecurity and data privacy teams. We invest in building and developing cybersecurity talent and engineering expertise in-house rather than relying solely on third-party providers. We also offer in-house training and educational courses through our Cyber Plus Institute, which is a security training curriculum leveraging internal subject matter expertise along with curated resources. Our data privacy team has industry certifications, works to understand changing technologies that impact consumer privacy, and regularly participates in training and conferences.

companyName: TARGET CORP

ticker: TGT

secItem: Item 1C


text: Monitor Cybersecurity Incidents Our IT Director and the IT team are continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. Our IT Director and the IT team implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, our IT Director is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Energy Recovery, Inc.

ticker: ERII


text: Kronos and CompX each have their own cybersecurity programs. Our corporate cybersecurity program is led by our chief information officer ("CIO"), who is responsible for developing and executing our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our corporate information systems are owned and operated by Contran and provided to us through the ISA. Our CIO, who also serves as the Kronos CIO, reports to our and Kronos' chief executive officers, respectively. CompX's cybersecurity program is led by the director of information technology ("IT"). The director of IT reports to CompX's vice president in charge of coordinating operational activities within CompX's two operating reporting units. Both our CIO and the CompX director of IT have extensive information technology and program management experience and lead teams that have many years of experience with each organization. Cybersecurity risks at each company are also reviewed and tested annually through third-party assessments and internal and external information technology audits. Our, Kronos' and CompX's information technology teams review cybersecurity risks at least annually, integrating findings into strategic risk assessments.

companyName: VALHI INC /DE/

ticker: VHI


text: As part of our program to mitigate risk from cyber security threats, the Company actively evaluates and refines its cyber security tools and processes with the intention of reducing cyber security risks and aligning with the National Institute of Standards and Technology Cyber-security Framework for risk management. Features of our cybersecurity program include: Processes designed to comply with information security standards and privacy regulations, including the European Union's General Data Protection Regulation. Maintenance of an ISO 27001 Information Security Management Standard certification. Implementation of a variety of security controls, such as firewalls, and intrusion detection systems. Protection against Denial-of-Service attacks which prevent legitimate use of our services. Security events monitoring in our security operations center. Development of incident response policies and procedures designed to initiate remediation and compliance activities in a timely manner. Implementation of data loss prevention tools. Implementing an ID management system to enforce granular role-based access controls. Performing penetration testing on cloud and app platform. Administration of a comprehensive cyber security awareness program to educate employees about cyber security risks and best practices. Retention of a third-party, independent cyber security firm to conduct cyber security assessments of our systems and procedures.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: Incident Response Plan We maintain an incident response plan designed to provide a high-level framework that can be implemented in any cyber incident. The plan addresses identification of the incident, notifications to appropriate individuals, organization of response activities by role, and escalation procedures based on the severity of the incident. We also have action plans to support business remediation and recovery efforts in the event of an incident.

companyName: Paylocity Holding Corp

ticker: PCTY


text: We have implemented and invested in, and will continue to implement and invest in, controls, technologies, and resources (both internal and external) that are designed to identify, protect against, detect, respond to and mitigate cybersecurity risks, in alignment with frameworks established by the National Institute of Standards and Technology. These include, but are not limited to, internal reporting mechanisms, monitoring and detection tools, threat intelligence, and general and role-based training. NACCO's commitment to cybersecurity emphasizes cultivating a security-minded culture through education and training that reflect best practices and improved cybersecurity awareness. We also maintain third party management processes to identify and manage the cybersecurity risks associated with third party service providers. We periodically evaluate our cybersecurity program internally and by engaging with consultants to conduct reviews and assessments of the program. Such reviews and assessments may include penetration testing, maturity assessments as well as table-top and other exercises with subsequent remediation of key findings. Additionally, we have a Cybersecurity Task Force in place that is comprised of individuals across various departments within our organization including information systems, legal, finance, human resources and internal audit which meets regularly to further advance our cybersecurity strategy.

companyName: NACCO INDUSTRIES INC

ticker: NC


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations or financial condition. See "Risks Related to Information Technology" in Item 1A. Risk Factors.

companyName: GRANITE CONSTRUCTION INC

ticker: GVA


text: To actively manage cybersecurity risks identified as part of the ERM process or otherwise and to manage emerging cybersecurity threats in real time, management has implemented an ISO 27001 certified Information Security Management System. Our Cybersecurity Team operates a Security Operations Center that continuously monitors activity, frequently scans applications and systems for vulnerabilities to risk from cybersecurity threats and creates action plans to address and track identified cybersecurity threats until they have been remediated. Activities and cybersecurity incidents are reported to our CIO, who briefs senior management, including our CEO, as well as the Innovation and Cyber Committee and the Audit Committee of our Board (respectively, the "Innovation and Cyber Committee " and the " Audit Committee "), as appropriate. Our Cybersecurity Team also routinely engages with third parties, including government agencies focused on cyber resiliency, to manage risks from cybersecurity threats. For example, we are members of the DoD Defense Industrial Base Collaborative Information Sharing Environment, the National Defense Information Sharing and Analysis Center, and the National Security Agency Enduring Security Framework. These organizations share real-time cybersecurity threat information and best practices in protecting, detecting and recovering from cybersecurity threats.

companyName: L3HARRIS TECHNOLOGIES, INC. /DE/

ticker: LHX


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas: o Governance: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's board of directors (BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC").

companyName: BlackRock Direct Lending Corp.


text: For further discussion of such risks, see the section entitled "Risks Related to Information Technology, Cybersecurity and Data Privacy" in Item 1A. Risk Factors of this Form 10-K.

companyName: NBT BANCORP INC

ticker: NBTB


text: The Risk Management Committee, comprised of senior IT, operations, risk, legal, and compliance leaders across business segments, monitors enterprise risk management for the Company, including all subsidiaries. Among other processes, this committee reviews the Company's programs and processes related to information security, third-party risks, vendor management, business disruption, business continuity, and disaster recovery, identifying gaps in the current risk management processes and considering potential risks due to changes in laws or the regulatory environment.

companyName: ARCBEST CORP /DE/

ticker: ARCB


text: Our VP, Head of Information Technology is the Company's designated Chief Information Security Officer ("CISO") and is responsible for developing and implementing the cybersecurity risk management program and reporting on cybersecurity matters to the Board. The VP, Head of Information Technology has over twenty years of experience leading cybersecurity oversight. Additionally, members of the IT security team have cybersecurity experience and\or certifications, such as the Certified Information Systems Security Professional certification and Certified Information Systems Audit certification. We view cybersecurity as a shared responsibility across our management team, and plan to periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees will be required to complete cybersecurity training at least once annually and have access to more frequent cybersecurity training through online and live events. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training that is documented in our quality management system. Employees outside of our corporate information security organization also have a role in our cybersecurity defenses and they are immersed in a corporate culture supportive of security, which we believe improves our cybersecurity.

companyName: ROCKET PHARMACEUTICALS, INC.

ticker: RCKT


text: The results of these audits and assessments inform adjustments to our cybersecurity program to improve our resilience against emerging cybersecurity threats.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: As one of the critical elements of AGM's overall ERM approach, AGM's cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance," AGM's Board of Directors has an oversight role, as a whole and also at the committee level, in overseeing management of AGM's risks, including its cybersecurity risks. AGM's Chief Information Security Officer ("CISO") and the Chief Information Security Officer of Athene Holding Ltd. ("AHL's CISO"), a subsidiary of AGM, with support from the broader AGM Technology team, are responsible for information security strategy, policies and practices, and also receive support, as appropriate, from our executive officers and other representatives of the Investment Adviser and its affiliates. • Collaborative Approach. AGM utilizes a cross-functional approach involving stakeholders across multiple departments, including AGM Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with our management and our Board, as applicable, in a timely manner. • Technical Safeguards. AGM deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. AGM has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. AGM maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. AGM provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.

companyName: MidCap Financial Investment Corp

ticker: MFIC


text: The oversight of the Company's cybersecurity risk management processes are integrated into the Company's enterprise risk management process. Our board of directors oversees an enterprise-wide approach to risk management, designed to support the achievement of organizational objectives, to improve long-term organizational performance and to enhance stockholder value. A fundamental part of risk management is not only understanding the most significant risks a company faces and what steps management is taking to manage those risks, but also understanding what level of risk is appropriate for a given company. The involvement of our full board of directors in reviewing our business is an integral aspect of its assessment of management's tolerance for risk and also its determination of what constitutes an appropriate level of risk. In connection with its reviews of the operations of our business, the board of directors addresses the primary risks associated with our business including cybersecurity. In particular, our board of directors is committed to the prevention, timely detection and mitigation of the effects of cybersecurity threats or incidents.

companyName: Root, Inc.

ticker: ROOT


text: The Company's management, including members of its ERM Committee, the Response Team, and the Company's CDEO, assess and manage material risks from cybersecurity threats. The ERM Committee is responsible for establishing and monitoring the integrity and effectiveness of controls and other procedures, which are designed to ensure that (1) all information required to be disclosed is recorded, processed, summarized, and reported accurately and on a timely basis, and (2) all such information is accumulated and communicated to the Audit Committee, as appropriate, to allow for timely decisions regarding such disclosures. The controls and procedures subject to the ERM Committee's oversight include processes related to managing material risks from cybersecurity threats. Accordingly, the Company's cybersecurity risk management processes have been integrated into the Company's overall enterprise risk management processes.

companyName: Charlotte's Web Holdings, Inc.

ticker: CWBHF


text: The MSP conducts ongoing cybersecurity training to ensure all employees are aware of cybersecurity risks and performs periodic phishing simulation testing for increased cyber resilience. Annually, the MSP conducts penetration testing to assess cybersecurity measures and to review the information security control environment and operating effectiveness. In addition, our advisor evaluates key third-party service providers before granting the service provider access to its information systems and has a process in place to ensure that future access is appropriate. Our assessment of risks associated with the use of third-party providers is part of the advisor's overall cybersecurity risk management framework. For any software platforms that are hosted by third parties, our advisor confirms the vendor maintains a System and Organization Controls ("SOC") 1 report. While we have control, through our contract with the MSP, over our information systems, we do not have control over the information systems of third parties who provide services, and in particular certain property management services, at our commercial real estate properties. Although we confirm third party software platforms maintain a SOC 1 report, we rely on third parties for managing their cybersecurity risk. Our advisor maintains third-party cyber insurance and upon identification of a significant cyber incident, our advisor would notify its cyber insurance carrier and engage a third-party cyber forensic analysis vendor to assist in investigating and remediating the incident.

companyName: Strategic Realty Trust, Inc.


text: Cybersecurity risk is managed as part of our broader enterprise risk management program. Specifically, a risk management workstream focused on our information technology function (including cybersecurity) is designed to assess, identify and manage cybersecurity-related risks and mitigation measures.

companyName: Celanese Corp

ticker: CE


text: Cybersecurity risks are included in the risk universe that the RRC evaluates, with input from information security subject matter experts at the company, to assess top risks to the enterprise. The RRC process provides input into our strategic planning process, such as development of action plans to address and mitigate identified risks. Integrating cybersecurity risk into the overall RRC process in this manner assists the company in identifying, assessing, and managing material cybersecurity risks.

companyName: SYSCO CORP

ticker: SYY


text: Cybersecurity, and in particular cybersecurity risk management, is an important part of operations and a focus area for the Company. Cybersecurity risks are evaluated on an ongoing basis by the Company's Technology department, both internally and with the assistance of external firms.

companyName: Alexander & Baldwin, Inc.

ticker: ALEX


text: We use third-party service providers to perform a variety of functions throughout our business, including software and cloud data service providers, for certain areas of our business, including sourcing/procurement, supply chain, manufacturing, distribution, information technology support services and administrative functions (such as payroll processing, health and benefit plan administration and certain finance and accounting functions). We have vendor management processes to manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Mission Produce, Inc.

ticker: AVO


text: We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Enertopia Corp.

ticker: ENRT


text: Cybersecurity Risk, Management and Strategy Cybersecurity is a significant and integrated component of the Company's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Company's information services. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident disrupting business operations, compromising sensitive data or both. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: OCEANFIRST FINANCIAL CORP

ticker: OCFC


text: Third-party service providers play a key role in our cybersecurity program. We use third-party service providers to assist us in identifying, assessing and monitoring material risks from cybersecurity threats, including through penetration testing, provision of threat intelligence and monitoring our environment 24 hours a day and seven days a week. We have currently engaged with professional services firms, including legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, dark web monitoring firms and cyber insurance brokers and providers. We report key findings of such assessments to our board of directors and the audit committee and we adjust our cybersecurity policies, standards, processes and practices as necessary based in part on information provided by these assessments and engagements.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: At Formula 1, the Head of Information Security, together with the Director of IT, are responsible for day-to-day management and oversight of subsidiary cybersecurity, including assessing, monitoring and mitigating cybersecurity risk as well as regular reporting to Formula 1 executive management and the ISSC.

companyName: Liberty Media Corp

ticker: FWONA


text: External Assessments and Attestations, and Certifications: Annual vulnerability and penetration tests and data privacy and protection reviews are performed by third-party experts. No significant findings were identified. OPKO maintains industry certifications such as SOC 2 Type 2 and PCI DSS attestations.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: Annually, the results of the Company's enterprise risk assessment are presented to the Audit Committee. These results include a discussion on the top enterprise risks (including, when appropriate, cybersecurity risk) identified through the enterprise risk assessment process, controls in place to address the risks, as well as the mitigation plans management will take to address any uncontrolled risks.

companyName: NeueHealth, Inc.

ticker: NEUE


text: We rely on information technology systems and various software applications to operate our business. To address cybersecurity risks, we have implemented a comprehensive process for identifying, assessing, and managing material threats, and integrating these measures into our overall risk management framework. Our Security Operations Team and Security Audit/Advisory Team play a key role in this strategy.

companyName: ANI PHARMACEUTICALS INC

ticker: ANIP


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas. Key elements of our risk management program relating to cybersecurity include: implementing risk assessments designed to help identify material risks, including risks arising from cybersecurity threats to our critical systems and information; engaging external cybersecurity consultants to assess and assist with aspects of our security processes; maintaining insurance coverage related to cybersecurity matters; and review of risks related to any new third-party IT providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: Tamboran Resources Corp

ticker: TBN


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit & Risk Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Lionsgate Studios Corp.

ticker: LION


text: Our corporate infrastructure, including information technology systems, communication networks, enterprise applications, and financial platforms, serves as vital tools for our business operations. These systems support crucial functions such as tenant and vendor management, internal communications, and financial record-keeping, underscoring the criticality of secure data collection, storage, and transmission.

companyName: Whitestone REIT

ticker: WSR


text: The Information Security department is responsible for implementing and maintaining the Company's cybersecurity risk management program. The Information Security department consists of cybersecurity and information risk professionals who assess, identify, and manage cybersecurity risks. Information Security is led by the CISO, who reports directly to the Chief Information Officer and the Board with a secondary reporting line to the Chief Risk Officer. The Company's CISO has over 20 years of experience in cybersecurity across the financial services industry, as well as experience working in a leading managed security services provider. Prior to joining the Company, the Company's CISO served as leader of the Global Threat Management Center for a major global financial institution. The Information Risk department, led by the Head of Information Risk, who reports directly to the Chief Risk Officer, is responsible for ensuring the protection of electronic and physical information through the identification and management of risk activities. As a governance and oversight function, the Information Risk department measures and reports on the quality of information and cyber risk management across all functions of the Company. Information security risk is reported by both the Information Security and Information Risk departments through monthly management metric reporting working groups and multiple layers of quarterly risk committees to achieve an appropriate flow of information risk reporting to the Board. The risk committees include the Operational Risk Management Committee, the Executive Risk Management Committee and the Risk Committee of the Board. These committees establish and oversee policies, programs, and other guidance to provide specific expectations for managing the cybersecurity risk.

companyName: Veritex Holdings, Inc.


text: The ISO reports to the BRCC on the status and impact of any information security related developments and strategic initiatives, and depending on the severity of the situation, directly to the Board of Directors. In addition to regular meetings, the BRCC, the ISO, Chief Risk Officer, Chief Information Officer, and Chief Executive Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks that we face, particularly as a financial institution. T he Company's Management Risk and Compliance Committee also reports directly to the BRCC regarding our risk management initiatives. The BRCC also receives quarterly reports from the Executive IT Committee and IT department in order to say informed on all aspects of cybersecurity risk affecting the Company.

companyName: OP Bancorp

ticker: OPBK


text: We require all devices used by employees to be protected with the security measures listed above. It is also our policy that all devices be used by the employee only and any use by non-employees is prohibited.

companyName: RESERVE PETROLEUM CO

ticker: RSRV


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. Our IT leadership reports to our Chief Executive Officer (CEO) to manage the risk assessment and mitigation process. We monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. We aim to promote a company-wide culture of cybersecurity risk management.

companyName: Hongchang International Co., Ltd

ticker: HCIL


text: Our CISO oversees security, including the corporate IT environment, our public cloud presence, and security standards that are used as a framework for managing security across our Company. Our CISO is also responsible for security awareness, administering our corporate security training, and sponsoring our cybersecurity policy and standards. Our cybersecurity plan is reviewed annually, and our Audit Committee has delegated to the Executive Security Incident Response Team which is made up of our Chief Financial Officer, a Board member and senior management representatives in the legal, IT and finance functions, oversight of our cybersecurity program. The Executive Security Incident Response Team receives regular updates directly from our CISO and Vicor product security experts from various business and operational areas. We maintain various security certifications across the Company, and part of our compliance program includes processes to oversee and identify material risks from cybersecurity threats and include the use of third-party service providers to perform regular audits to ensure our security management program remains current.

companyName: VICOR CORP

ticker: VICR


text: More specifically, MIS supervisor is responsible for identifying and assessing cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, and maintaining cybersecurity programs.

companyName: Jerash Holdings (US), Inc.

ticker: JRSH


text: Under the oversight of the Board of Directors (since we do not currently have an Audit Committee), we intend to implement and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes would be integrated into our overall risk management processes. We intend to implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify and address cybersecurity risks. In support of this approach, it is expected that we would have a third-party security consultant implement processes to assess, identify and manage security risks to our company, including in the pillar areas of security and compliance, application security, infrastructure security and data privacy. This process, once implemented, would include regular compliance and critical system access reviews. In addition, we intend to conduct application security assessments, vulnerability management, penetration testing, security audits and ongoing risk assessments as part of our risk management process.

companyName: bowmo, Inc.


text: We have a formal IT Security Policy to provide appropriate governance over information security including control requirements for change management and patching, multi-factor authentication, data backup, security monitoring, mobile device management and asset management. Management performs annual testing of security controls, including penetration testing from a different cybersecurity vendor that is independent of both our Company and the cybersecurity vendor that provides guidance on our overall cybersecurity program, and results are reported to the Audit Committee. In addition, management has a formal incident response plan and our cybersecurity vendor provides 24x7 monitoring/management of our infrastructure and systems. The incident response plan addresses the lifecycle of incidents including identification, response and recovery, and the plan is tested at least annually. In addition, we carry insurance that provides protection against the potential losses arising from cybersecurity incidents.

companyName: NORTHERN OIL & GAS, INC.

ticker: NOG


text: Denial of Service ("DoS") Attacks: These attacks aim to overwhelm a network, server, or website with an excessive amount of traffic, rendering it inaccessible to legitimate users.

companyName: International Seaways, Inc.

ticker: INSW


text: Our cybersecurity risk management and strategy includes: • Our dedicated Security team, which performs periodic risk assessments to identify and assess cybersecurity threats, vulnerabilities, their severities, and potential mitigations. The team leverages both top-down and bottom-up risk processes and technologies to identify, manage and monitor cyber threats and vulnerabilities. The team also manages our response to cybersecurity incidents. • Incident Response Playbooks and Standard Operating Procedures ("SOP") outlining procedures for detecting, responding to, and mitigating cybersecurity incidents. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the board of directors. • The use of external service providers, where appropriate, to assess, test or otherwise assist with certain aspects of our security controls and processes, as well as maturity assessments of our cybersecurity program. • Implementation of new hire and annual data privacy and cybersecurity training of all employees, including senior management; annual role-based training of employees with specific access to systems, devices, or locations, and targeted cybersecurity simulation training held on a recurring basis. • A third-party risk management process that identifies and mitigates cybersecurity threats associated with our use of third-party service providers. Such service providers are subject to risk tiering, security risk assessments, continuous monitoring including investigation of security incidents that have impacted our third party service providers, as applicable.

companyName: DOCUSIGN, INC.

ticker: DOCU


text: Our CISO heads the Information Security team, which is responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across our business. The Information Security team covers a wide range of cyber and information security responsibilities. Our CISO also receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by us to identify and mitigate cybersecurity risks. In addition to our internal capabilities, we also periodically engage external consultants, legal counsel, or other third-party advisors to assist with assessing, identifying, and managing cybersecurity risks.

companyName: H&R BLOCK INC

ticker: HRB


text: We have relationships with a number of third-party service providers to assist with cybersecurity containment and remediation efforts, including insurance providers and various law firms.

companyName: Phio Pharmaceuticals Corp.

ticker: PHIO


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer is primarily responsible for the cybersecurity component of our risk management program and is a key member of the risk management organization, reporting directly to the Chief Executive Officer and, as discussed below, periodically to the Technology Committee of our board of directors.

companyName: MetroCity Bankshares, Inc.

ticker: MCBS


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Head of IT. This individual has over ten years of information technology and cybersecurity work experience. This risk management team member is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. This risk management team member reports to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters.

companyName: Spero Therapeutics, Inc.

ticker: SPRO


text: Our Chief Information Officer (" CIO ") is responsible for assessing, identifying, and managing the risks from cybersecurity threats. Our CIO has over 15 years of experience in information technology and security positions. The CIO leads a team which includes our Corporate Director of Information Security and Senior Systems Engineer, with a combined 29 years of information technology and cybersecurity related experience. Both of these individuals hold Certified Information Systems Security Professional ("CISSP") certifications.

companyName: CENTURY CASINOS INC /CO/

ticker: CNTY


text: Cybersecurity Incident Response and Recovery Planning The Company has established and maintains incident response and data recovery plans that address the Company's response to a cybersecurity incident, and plans are reviewed by the Cybersecurity Committee and members of the IT department.

companyName: Axsome Therapeutics, Inc.

ticker: AXSM


text: All employees participate in annual cybersecurity training courses conducted by the Training department with oversight from the CTO. Additional training exercises are administered throughout the year to increase cybersecurity awareness and address relevant risks.

companyName: FRANKLIN FINANCIAL SERVICES CORP /PA/

ticker: FRAF


text: TEP's Security Steering Committee provides management oversight to its cybersecurity strategy, performance, and risk. This committee also reviews significant cybersecurity events, including the scope of the incident and the associated prevention, detection, mitigation, and remediation efforts. This committee includes the Chief Information Officer, Chief Financial Officer, Chief Legal Officer, Senior Director of IT Operations and Enterprise Security, and others with the requisite cybersecurity experience, training, and skills who oversee TEP's ERM program. The Senior Director of IT Operations and Enterprise Security holds CISSP and GICSP certifications.

companyName: TUCSON ELECTRIC POWER CO


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We operate in markets that are dependent on Information Technology (IT) systems and technological change. Failure to maintain and support customer facing services, systems, and platforms, including addressing quality issues and execution on time of new products and enhancements, could negatively impact our revenues and reputation" and "Risk Factors – The failure to prevent a cybersecurity incident affecting our systems could result in the disruption of our services and the disclosure or misappropriation of sensitive information, which could harm our reputation, decrease demand for our services and products, expose us to liability, penalties, and remedial costs, or otherwise adversely affect our financial performance".

companyName: Stride, Inc.

ticker: LRN


text: g.leverage internal and external resources to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and h.carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. As part of the above processes, we rely on internal resources rather than consultants, auditors or other third parties, to review our cybersecurity program.

companyName: EXAGEN INC.

ticker: XGN


text: Our cybersecurity program is led by the Senior Manager of our Enterprise IT Security Risk and Compliance team, who reports to the Managing Director of Enterprise IT. The Senior Manager has over 30 years of IT experience, with over 20 years specializing in cybersecurity. He has strategic and operational responsibility for all aspects of the company's cybersecurity program, including how cyber risks are identified and assessed and how the company prepares for, detects, responds, and recovers from cyber threats. Quarterly cybersecurity program updates and as-needed reporting on cybersecurity incidents are provided to the Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, and General Counsel.

companyName: TORO CO

ticker: TTC


text: Our Chief Information Security Officer ("CISO") and security organization help identify, assess, and manage the Company's cybersecurity threats and risks, including through the use of the Company's security risk register. The CISO and security organization identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example: (1) identifying vulnerabilities through automated scans, vulnerability assessments, and subscriptions to threat intelligence feeds and notices; (2) assessing security weaknesses identified through internal security reviews, external penetration tests, and reports on our products and services; and (3) assessing the Company's threat landscape given the industry's risk profile, the results of our enterprise risk assessment, and information technology, privacy, and security audits.

companyName: Fastly, Inc.

ticker: FSLY


text: Even with our current control processes and a continuous improvement mindset, cybersecurity threats constantly evolve. If the measures we have employed were to fail, or if a breach were to occur, it could result in impairment or loss of critical functions, such as the operation of our e-commerce websites, our Evansville distribution center, our corporate network and/or our point-of-sale systems, as examples. Additionally, confidential information could be compromised, or we could be defrauded or ransomed for a material amount of funds. Any of these outcomes could negatively affect our reputation and customer loyalty. The ultimate effects of a breach or loss in function or confidential information are difficult to quantify with any certainty, but such loss may be partially limited through insurance. See "Risk Factors—We could be adversely affected if our information technology systems fail to operate effectively, are disrupted or are compromised", "—Various risks associated with our e-commerce platform may adversely affect our business and results of operations" and "—We outsource certain business processes to third-party vendors and have certain business relationships that subject us to risks, including disruptions to our business and increased costs" in PART I, ITEM 1A of this Annual Report on Form 10-K, which risk factors are incorporated by reference into this section of this Annual Report on Form 10-K.

companyName: SHOE CARNIVAL INC

ticker: SCVL


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings " We are exposed to cyber-attacks and other cybersecurity threats that may lead to compromised or inaccessible telecommunications, digital and financial services, and/or leaks or unauthorized processing of confidential information, and perceptions of such threats may cause customers to lose confidence in our services ", included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: GlobalTech Corp

ticker: GLTK


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain management, including our Director of Information Technology, who reports to our Senior Vice President of Finance and Financial Planning. Our Director of Information Technology is responsible for monitoring third-party specialists, helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our Senior Vice President of Finance and Financial Planning is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.

companyName: Ovid Therapeutics Inc.

ticker: OVID


text: The Board has ultimate oversight responsibility for the Company's risk management and recognizes the importance of protecting the data provided by the Company's customers and employees and devotes considerable time and attention to overseeing the strategies the Company employs to protect our data and systems and to mitigate against cybersecurity risk. A cybersecurity expert chairs the Risk Committee and provides technology-related insight and guidance to the Company. As part of the Risk Committee's responsibility for monitoring key business and regulatory risks, the Risk Committee receives from our CISO quarterly reports and materials which include a review of cybersecurity and information technology key risk indicators, test results and related remediation, and any recent cybersecurity threats or incidents and how the Company is managing those threats or incidents. The Risk Committee also periodically reviews reports on the threat environment, vulnerability assessments, results of penetration testing, and potential cybersecurity and data privacy incidents, as well as information on ongoing employee training relating to data privacy and cybersecurity and how to protect data against cyber threats. Further, on a quarterly basis, our CRO presents to the Risk Committee updates from our Director of Enterprise and Operational Management on the Company's business continuity program, which covers, among other things, outages and incidences and disaster recovery and business continuity testing. The Risk Committee also approves the annual risk assessment required by the Gramm-Leach-Bliley Act. Moreover, the CISO follows a risk-based escalation process to notify the Risk Committee outside of the cycle of regular updates when management has identified an emerging risk or material issue related to cybersecurity. The Risk Committee also reports material cybersecurity risks to the full Board, based on our CISO's assessment of risk. In addition, the Audit Committee reviews reports of the Company's internal audit department's periodic audits of our information security area and various components thereof.

companyName: SouthState Bank Corp

ticker: SSB


text: Our senior management is responsible for assessing and managing the Company's various exposures to risk, including those related to cybersecurity, on a day-to-day basis, including the identification of risks through a robust enterprise risk management framework and the creation of appropriate risk management programs and policies to address such risks. Our CIO has primary responsibility for managing our cybersecurity program and efforts. Our internal audit team is responsible for the testing and audit of our information-technology internal controls.

companyName: MUELLER INDUSTRIES INC

ticker: MLI


text: Incident Response Plan. To ensure that information security incidents can be recovered from quickly and with the least impact to the Company and its customers, the Company maintains a structured and systematic incident response plan (the "IRP") for all information security incidents that affect any of the IT systems, network, or data of the Company, including the Company's data held, or IT services provided by third-party vendors or other service providers. The CIO and ISO are responsible for implementing and maintaining the IRP, which includes: a) Identifying the incident response team ("IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK


text: management and strategy understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Processes to manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process. Our cybersecurity risks include theft of business data, fraud or extortion, lack of access to our information systems, harm to employees, harm to business partners, violation of privacy laws, potential reputational damage, and litigation or other legal risk if a cybersecurity incident were to occur. It is difficult to assign a monetary materiality assessment to these risks or to the impact if we were to sustain a breach of our systems. Our approach is based on the premise that any cybersecurity incident could result in material harm to our company.

companyName: Vivos Therapeutics, Inc.

ticker: VVOS


text: On a regular basis, our IT Director will report to our board of directors on cybersecurity matters, including key risks, the potential impact of those exposures on our business, financial condition, results of operations, cash flows, reputation and prospects, and the programs and steps implemented by our management team to monitor and mitigate risks.

companyName: Nauticus Robotics, Inc.

ticker: KITT


text: Our vendor risk management process includes conducting risk assessments to identify and monitor cybersecurity risks associated with third-party service providers, including threat detection and security event notifications. We also have requirements for third-party service providers which include regulatory compliance and meeting NIST Cybersecurity Framework policy and standards. Our agreements with third-party service providers include cybersecurity provisions to address risks.

companyName: Waste Connections, Inc.

ticker: WCN


text: The individuals serving in the roles of chief security officer and chief privacy officer have enterprise-wide responsibility for assessing and managing cybersecurity, data protection and security, and privacy risks, respectively. These leaders collectively have over 25 years of relevant work experience in public companies and extensive industry expertise.

companyName: Booking Holdings Inc.

ticker: BKNG


text: Our CSIRP provides clear communication protocols, including with respect to members of management, which may include, depending on the incident's classification and other circumstances, members of the IRT, CEO, CFO, CIO, General Counsel, Audit Committee, and external counsel. In addition, the CSIRP considers communications and reporting to tenants, regulators, and law enforcement.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: Our management recognizes the impact that cybersecurity threats could have on our business operations, our compliance with regulations and our reputation. We have identified cybersecurity as a critical business risk as part of our overall risk management strategy, which our board of directors oversees.

companyName: ORAGENICS INC

ticker: OGEN


text: If a cybersecurity incident occurs, incident response procedures are in place to facilitate the appropriate reporting to the CSO, and business continuity plans are mobilized to minimize disruption to business operations. We have also implemented guidelines to outline communications responsibilities during incidents of all severity levels, including an escalation process for alerting senior management of high severity and material incidents.

companyName: Robinhood Markets, Inc.

ticker: HOOD


text: We have developed and implemented cybersecurity processes to assess, identify and manage material risks from cybersecurity threats. These processes are based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and are designed to protect the integrity and security of our information systems. Our cybersecurity processes are a part of our risk management system, sharing governance processes and reporting structures with other components of our enterprise-wide system. Our cybersecurity processes include security monitoring and threat hunting through a third-party managed vendor and mandatory, Company-wide employee training. Our cybersecurity processes also extend to the oversight and identification of risks associated with our vendors and customers if their computer systems interface with our information systems. Upon detection of a potentially material cybersecurity incident, such as the Previously Disclosed Cyber Incident, we activate our cyber incident procedure to investigate, contain and remediate the incident. Depending on the extent and severity of the incident, we have, and may in the future, engage third-party cybersecurity consultants to assist with our cyber incident procedure.

companyName: KEY TRONIC CORP

ticker: KTCC


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to protect our information systems and protect the confidentiality, integrity, and availability of our data. Presently our information systems are limited to databases maintained by third parties. As a result we have established limited policies and procedures to assess, identify, and manage material risk from cybersecurity threats. We assess risks from cybersecurity threats against our third-party information systems that may result in adverse effects on our information systems or any information residing therein. We conduct periodic and ad-hoc assessments to identify cybersecurity threats. Presently we do not believe there are any material threats to our systems.

companyName: Qrons Inc.

ticker: QRON


text: Given that our day-to-day operations involve a limited number of individuals, we rely on technology systems operated and managed by third parties.

companyName: AMERICAN BATTERY MATERIALS, INC.

ticker: BLTH


text: We have accommodated a significant number of our employee population to work remotely. This accommodation to remote working has also increased our vulnerability to risks related to our computer, technology, and communications hardware and software systems and has exacerbated certain related risks, including risks of phishing and other cybersecurity attacks.

companyName: BuzzFeed, Inc.

ticker: BZFD


text: Management also generally provides quarterly updates to the audit committee on cybersecurity and other information technology risks. We have implemented a process for the Director of IT and the Chief Accounting Officer to receive incident reports and report quarterly (and, if applicable, in the event of a cybersecurity incident), to our internal disclosure committee and the audit committee, as appropriate. Management presents to the entire board of directors on an annual basis, including any key findings identified in our cybersecurity assessments.

companyName: Compass Therapeutics, Inc.

ticker: CMPX


text: Management of Material Risks and Integrated Overall Risk Management Our comprehensive risk management framework is intended to strategically incorporate cybersecurity risk management across the company, with the objective of ensuring that cybersecurity considerations underpin the decision-making processes at all organizational levels. Our risk management team collaborates closely across various Enterprise-wide business units to continually assess and address identified cybersecurity risks in alignment with business objectives. The CISO regularly updates the CTIO, Chief Financial Officer and Chief Executive Officer on material cybersecurity risks and events.

companyName: NORDSTROM INC


text: Our cybersecurity program leverages people, processes and technology to identify and respond to cybersecurity threats in a timely manner. As part of our cybersecurity program, we maintain various protections designed to safeguard against cyberattacks, including but not limited to firewalls, endpoint detection and response, anti-malware, immutable backups, multi-factor authentication schemes, data encryption, and security system information event monitoring to detect and respond quickly to any emergent threats. In addition, we periodically conduct intrusion and penetration testing through third parties to evaluate our cybersecurity response capability.

companyName: KalVista Pharmaceuticals, Inc.

ticker: KALV


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, hardware, software, third-party hosted services, and data.

companyName: MAYS J W INC

ticker: MAYS


text: Our Chief Information Security Officer oversees our cybersecurity program, policies and processes, including those described in "Risk Management and Strategy" above, and works with the information security team and other stakeholders on the prevention, detection, mitigation, response and remediation of cybersecurity incidents, as applicable. As our information security team monitors the security and effectiveness of our policies and processes, they also work to keep the Chief Information Security Officer and other members of leadership informed of critical incidents, process updates, or other material details, in accordance with our internal reporting structure. Our Chief Information Security Officer in turn provides periodic briefings to our Board of Directors regarding our company's cybersecurity risks and activities, which would include recent material cybersecurity incidents and related responses, if any, changes to the risk landscape, and updates or changes to the cybersecurity program. Our current Chief Information Security Officer has over 15 years of systems engineering and technical cybersecurity experience, and holds an undergraduate degree in computer science and a graduate degree in business administration. He has also completed graduate-level courses in computer science, and holds certifications in information security. The information security team includes employees with broad ranging experience in cybersecurity threat assessments and detection, incident response, and mitigation and management of various types of threats, including from insiders and nation-state actors.

companyName: Palantir Technologies Inc.

ticker: PLTR


text: function manages IT operations and continually evolves our systems to meet the constantly changing digital environment. We enhanced our workstation, server, email security, and network monitoring with managed detection and response and alerting capabilities. We perform periodic cybersecurity risk assessments to identify, assess, and prioritize potential risks to information, data assets, and infrastructure.

companyName: TREES Corp (Colorado)

ticker: CANN


text: To stay abreast of the evolving threat landscape, we actively engage with key vendors, industry information sharing, and intelligence and law enforcement communities. These engagements serve as inputs into understanding techniques and tactics being used by threat actors and in expanding the countermeasures we use to protect Teladoc Health.

companyName: MediXall Group, Inc.

ticker: MDXL


text: Our Vice President – IT oversees these risk assessments and meets regularly with the security and compliance team to review cybersecurity risks and threats, and also participates in our enterprise risk management process. In addition, the Company engages several third-party consultants in connection with the risk assessments, and we have established separate processes and procedures to oversee and identify cybersecurity risks associated with third parties. All third parties involved in our cybersecurity risk assessments are required to provide reports designed to allow us to monitor and assess such third parties' security controls.

companyName: Antero Midstream Corp

ticker: AM


text: If there is a cybersecurity incident, we may suffer interruptions in service, loss of assets or data, or reduced functionality. Many of our systems are not redundant, and our disaster recovery planning may not be sufficient for every eventuality a cybersecurity incident could cause. Security breaches of our systems which allow inappropriate access to or inadvertent transfer of information and misappropriation or unauthorized disclosure of confidential information belonging to us or to our employees, customers, or suppliers could result in our suffering significant financial and reputational damage. Customers may use our products and/or software to generate or manage critical information. Though we take steps to ensure our products and/or software are secure, it is possible that a cyber attack could result in the loss or compromise of critical information. If a customer alleges that a cyber attack causes or contributes to a loss or compromise of critical information, whether or not caused by us, we could face harm to our reputation and financial condition as it could cause us to incur legal liability and increased costs to respond to such events.

companyName: METTLER TOLEDO INTERNATIONAL INC/

ticker: MTD


text: Multidisciplinary Coordination: Our IT Security Team, which includes IT Site Managers, an IT Risk & Compliance Team, a Global Information Security Team and Cybersecurity Incident Managers, has first-line responsibility for our cybersecurity risk management processes, and is responsible for implementing cybersecurity policies, procedures and strategies. This team is led by our Vice President, Security, Infrastructure & Site IT (VP Security), who reports to our Chief Information Officer (CIO), who in turn reports to our Chief Operations Officer (COO). The IT Security Team is subject to oversight from several cross-functional teams, including our Executive Leadership Team, our IT Security Council and our Compliance Council. Our IT Security Council, a global IT security strategy team, meets monthly to discuss IT security roadmaps and strategies, control enhancements, compliance matters and customer requirements. Our Compliance Council includes representatives from, among others, our legal, compliance, ethics, internal audit, operations, security, and supply chain teams to assess the Company's risk exposures, mitigation strategies and policies, and meets quarterly to discuss risks, policies and compliance issues, including with respect to cybersecurity.

companyName: CELESTICA INC

ticker: CLS


text: Our board of directors and senior management recognize the critical importance of maintaining the trust and confidence of our clients, business partners and employees. Our management, led by our Chief Executive Officer, are actively involved in oversight of our risk management efforts, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). Our cybersecurity processes and practices are fully integrated into the Company's ERM efforts. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: FAMILY OFFICE OF AMERICA, INC.

ticker: FOFA


text: We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. To this end, our processes are designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems (including such risks associated with the use of any third -party service providers) that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by third -party experts under supervision of management, and, where necessary or desired, include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data. We may also consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.

companyName: FITLIFE BRANDS, INC.

ticker: FTLF


text: We require that all employees, consultants and third party contractors adhere to our cybersecurity policies. Key third party contractors undergo a qualification process under our quality management programs (including cGMP and GCP) wherein we assess, among other things, their cybersecurity risk profile. Third party contractors, such as CROs and information technology service providers, that handle sensitive data, including patient data, are subjected to increased scrutiny. Based on identified risks, we may periodically review and reassess our third party contractors on an ongoing basis.

companyName: Kiniksa Pharmaceuticals International, plc

ticker: KNSA


text: We recognize the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving our enterprise value. We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. The Company's Information Security Officer is primarily responsible for developing, monitoring, and implementing our cybersecurity program, which establishes policies and procedures for the measurement of the effectiveness and efficiency of information security controls related to both design and operations. The Chief Technology Officer is responsible for implementing the appropriate controls and monitoring them towards adherence with the established standards.

companyName: First Foundation Inc.

ticker: FFWM


text: Our information security program is led by the Director of IT Cybersecurity and Compliance, who reports directly to the Chief Information Officer (the "CIO"). The program is aligned with the U.S. National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Israel National Cyber Directorate. We are also members of the New Jersey Cybersecurity and Communications Integration Cell, which enhances our industry awareness and proactive response capabilities by facilitating information sharing, identifying attack profiles, and promoting continuous improvement.

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: The Company's Chief Information Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. Our Chief Information Officer has over a decade of experience leading cyber security oversight, and others on our IT security team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity trainings at least once every three years and have access to more frequent cybersecurity trainings through online trainings. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.

companyName: UNITED RENTALS NORTH AMERICA INC


text: We have implemented cybersecurity controls and processes to identify, detect, protect against, respond to and recover from threats and cybersecurity risks. These threats and risks include, among other things: operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. Our approach is informed by external cybersecurity experts and aligns to the U.S. National Institute of Standards and Technology (NIST) framework and standards. Our senior vice president, Technology and Innovation and CIO ("CIO"), who has a Bachelor of Arts in computer science and over 35 years of business experience managing large-scale system environments and the associated risks from cybersecurity threats, and developing and implementing cybersecurity policies and procedures, oversees our cybersecurity program. In addition, our cybersecurity team has a diverse range of certifications from reputable organizations in the field, such as Cybersecurity and Infrastructure Security Agency (CISA), EC-Council (ECC), and Global Information Assurance Certification (GIAC), in addition to many vendor-specific certifications. Our enterprise risk management program considers cybersecurity risks alongside other Company risks. As part of our enterprise risk management process, our enterprise risk professionals consult with Company subject matter experts to gather information necessary to identify cybersecurity risks, and evaluate their nature and severity, as well as identify mitigations and assess the impact of those mitigations on residual risk.

companyName: MARATHON OIL CORP


text: In the normal course of business, we may collect and store personal information and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third-party information and employee information. We assess and identify cybersecurity risk to such information by maintaining cybersecurity policies that require continuous monitoring and detection programs and network security precautions. Our program incorporates industry-standard frameworks, policies and practices designed to protect the privacy and security of our sensitive information.

companyName: CODEXIS, INC.

ticker: CDXS


text: The Information Security Department of the Corporation is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats. The Information Security Department is managed by the Board-appointed Chief Information Security Officer (the "CISO") who reports directly to the Corporation's Chief Risk Officer. The CISO has over 40 years of experience in various aspects of information technology ("IT") from field support to software development to management. Prior to joining the Corporation, the CISO held management roles of increasing responsibility in a variety of regulated industries including food, pharma, and manufacturing. The CISO holds a Bachelor of Science Degree in Computer Science and has earned a certificate in Cybersecurity Oversight from the National Association of Corporate Directors. The CISO also oversees the Corporation's Information Security Program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Corporation and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Information Security Department conducts ongoing technology and IT threat meetings to ensure the latest threats are addressed in addition to penetration, business continuity/ disaster recovery testing, and incident response plan testing. The CISO is a member of various management committees, chairs the Corporation's management-level Information Security Steering Committee, and presents information security and cybersecurity updates on a quarterly basis to the Corporation's Enterprise-Wide Risk Management Committee, which consists of members of management, including the Chairman, President and Chief Executive Officer of the Corporation, as well independent members of the Board of Directors. The Enterprise-Wide Risk Management Committee provides oversight, from a risk perspective, of information systems security.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: Periodic audits are performed by our Internal Audit team as part of the Company's compliance with the Information Security Plan and the overall ERM framework.

companyName: UNIVERSAL INSURANCE HOLDINGS, INC.

ticker: UVE


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our clinical trial and related data, which we refer to as Information Systems and Data.

companyName: Immunocore Holdings plc

ticker: IMCR


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program; the Director of Information Technology and Associate Director, Infrastructure Operations work with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; our senior management, with input from an external strategic advisor, evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which together with our board of directors evaluates our overall enterprise risk.

companyName: Kronos Bio, Inc.


text: Our CRO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in our IT environment.

companyName: Summit Hotel Properties, Inc.

ticker: INN


text: We circulate cyber awareness materials on a periodic basis on our intranet and hold a "Cyber Awareness Month" each year to promote the importance of cybersecurity topics. In addition, members of senior management participate in periodic crisis management exercises with third-party experts on crisis management best practices to apply their learnings to the Company's business continuity management program. In particular, in Fiscal 2023, the table-top exercise that was conducted for senior management focused on the handling of a cyber-security incident.

companyName: Childrens Place, Inc.

ticker: PLCE


text: The information security program performs periodic risk assessments of our information systems and cybersecurity threats using industry standard methodologies based on FFIEC Cybersecurity Assessment Tool (CAT), as well as regulatory guidance issued by the Federal Financial Institutions Examination Council (FFIEC) and state and federal regulators, including the Federal Deposit Insurance Corporation and the Michigan Department of Insurance and Financial Services. Based on risk, our information security program performs internal engagements to provide assurance to senior management and the Board that our information systems are able to identify, escalate and mitigate cybersecurity threats on a routine basis. We also engage external independent parties to perform independent audit engagements, as well as other assessments of our information security and third-party risk management program and information systems.

companyName: NORTHPOINTE BANCSHARES INC

ticker: NPB


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are fully integrated into the Company's overall risk management approach, and cybersecurity risks are subject to oversight by the Company's board of managers. The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with specific the goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: TriLinc Global Impact Fund LLC

ticker: TRLC


text: We established an interdisciplinary team to monitor and assess cybersecurity risks on an ongoing basis, which is led by our Chief Financial Officer ("CFO"). It is a cross-departmental team that consists of finance and operations personnel, as well as third party legal and information technology ("IT") consultants, with all significant implementation efforts executed by our IT consultant, who has extensive experience in IT, enterprise security and cyber risk management. This team is in charge of developing, maintaining and measuring compliance with the cyber risk management program, and dedicates significant resources to cybersecurity and risk management processes to adapt to the ever-changing cybersecurity landscape and to respond to emerging threats in a timely and effective manner.

companyName: ZeroStack Corp.

ticker: ZSTK


text: We have established a corporate governance structure that provides oversight and guidance for our security and privacy program. The Board of Directors (the "Board") is ultimately responsible for the oversight of the Company's security and privacy program. The Audit Committee, which supports the Board in the oversight of the program, is focused on cybersecurity and data privacy risk, including incident response planning, timely identification and assessment of incidents, incident recovery and business continuity considerations.

companyName: Certara, Inc.

ticker: CERT


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents and threats to management members depending on the circumstances, including the Chief Executive Officer and Chief Financial Officer. The Chief Executive Officer and Chief Financial Officer work with the Company's incident response team in an effort to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's management and its designees report to the board of directors for certain cybersecurity incidents.

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: Our CSO is responsible for assessing and managing our material risks from cybersecurity threats, has primary responsibility for leading our overall cybersecurity risk management program, and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CSO has significant executive experience in managing and leading IT and cybersecurity teams in both government and the private sector and has received industry recognition in the cybersecurity area. Our CSO holds cybersecurity certifications from leading cybersecurity training and research institutes, is a Fellow at the National Security Institute, and is a member of the Board of Directors of the Financial Services Information Sharing and Analysis Center.

companyName: SLM Corp

ticker: SLM


text: We maintain a Cybersecurity Incident Response Team (CIRT), which is responsible for addressing the technical aspects of the Company's response to cybersecurity events. Additionally, our cross-functional Executive Cybersecurity Event Evaluation Team (ECEET) is responsible for assessing the potential business impacts and disclosure requirements related to cybersecurity events. Both the CIRT and the ECEET may consult cybersecurity legal counsel and other external experts in connection with their respective activities. An escalation process has been established for engaging other governance groups, which may include the Company's Disclosure Committee and/or the Board of Directors' Audit Committee, each of which also receive a quarterly report from the chair of the ECEET.

companyName: BANNER CORP

ticker: BANR


text: Senior management takes the guidance provided by the Board of Directors and transforms this guidance into operational priorities which are implemented and maintained by the staff members and third-party service providers. In addition, the senior management team ensures that budgeted resources are allocated in a timely manner to support the various security initiatives.

companyName: QUAINT OAK BANCORP, INC.

ticker: QNTO


text: In actioning our cyber security strategy, our management together with our Senior Vice President of Information Technology evaluate the materiality of any cybersecurity threats and incidents utilizing both qualitative and quantitative considerations. Our internal audit team also provides independent testing on aspects of the operations of our cybersecurity program and the supporting control framework.

companyName: Ameresco, Inc.

ticker: AMRC


text: Our cyber management team, led by our Vice President of Information Security, is tasked with implementing and maintaining centralized cybersecurity and data protection practices in close coordination with MSC's leadership team and other teams across the Company. Our Vice President of Information Security has extensive cybersecurity knowledge and skills gained from over 25 years of work experience across multiple verticals. Reporting to our Vice President of Information Security are a number of experienced information security professionals responsible for various parts of our business, including Architecture and Engineering, Identity and Access Management, Security Operations, and Governance, Risk and Compliance programs, each of which is supported by a team of trained cybersecurity professionals.

companyName: MSC INDUSTRIAL DIRECT CO INC

ticker: MSM


text: The Board of Directors is also responsible for the approval and oversight of the Information Security (IS) Program. Our Chief Information Security Officer (CISO), who is designated as the IS Program Coordinator, has extensive information technology, security and program management experience. The Information Risk and Controls Management Department, under the direction of the CISO, administers the IS Program with an objective of preventing cybersecurity incidents by ensuring the confidentiality, integrity and availability of company information. Central to incident management is the Information Security Incident Response Team (ISIRT), which is responsible for responding expeditiously and effectively to security incidents to minimize risks to the business, customers and consumers. In the event of an incident, we follow the detailed incident response plan, which outlines the steps to be followed from incident identification to mitigation, recovery and notification, including notifying functional areas, regulators, as well as senior leadership and the Board, as appropriate.

companyName: BANK OF HAWAII CORP

ticker: BOH


text: While we develop and maintain protocols, controls, and systems, that seek to prevent cybersecurity incidents from occurring, we must constantly monitor and update these protocols, controls, and systems in the face of sophisticated and rapidly evolving attempts to overcome them. The occurrence of cybersecurity incidents could cause a variety of material adverse impacts on our business, although no such incident has had any such impact to date. F or additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this report, including the risk factor entitled "Security breaches and other disruptions to our information technology infrastructure could interfere with our operations and expose us to liability." and Item 1, "Business – Environmental and Other Regulations - Safety Management System Requirements" in this report.

companyName: Pangaea Logistics Solutions Ltd.

ticker: PANL


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a data security incident response policy and a security incident response plan, which were first developed in 2017 and are periodically reviewed and updated.

companyName: LANDS' END, INC.

ticker: LE


text: Our Board of Directors provides oversight of risks from cybersecurity threats, in coordination with our management team and the Audit Committee of the Board. Our Board relies on management to bring significant matters impacting the Company to its attention, including with respect to material risks from cybersecurity threats. Our Audit Committee provides an additional layer of cybersecurity oversight and is responsible for discussing cybersecurity concerns with management (including data privacy risk management) and the steps management has taken to monitor and control such exposures.

companyName: CRAWFORD UNITED Corp


text: The ISP sets forth the controls and activities designed to protect our systems and data, such as establishing network perimeter security, managing system access, monitoring user activity and maintaining physical security. Other components of the Program related to assessing, identifying and managing risks from cybersecurity threats include annual cybersecurity training for all employees, regular review and update of our business critical and financial systems and the use of a variety of tools and methods to manage access to, and maintain the integrity of, our information systems. Our employees are critical in helping mitigate our cybersecurity risk and we continue to raise awareness and engagement through our formal training, frequent phishing campaigns and communication from our information security team with reinforcement from senior leaders across the Company. We also perform annual external penetration tests to identify certain potential vulnerabilities, and maintain a business continuity plan, which is tested annually.

companyName: PJT Partners Inc.

ticker: PJT


text: We describe whether and how risks from identified cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security and privacy breaches, computer viruses, and cyber-attacks could harm our business, financial condition, results of operations, or reputation." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: AUDIOEYE INC

ticker: AEYE


text: We also have established a process to conduct diligence on certain third parties before engaging with those third parties, such as those that support our GxP processes, which may include a security assessment.

companyName: Larimar Therapeutics, Inc.

ticker: LRMR


text: Cybersecurity risks are documented on the Information Security risks and controls matrices. Key risks and their treatment are tracked via these matrices as part of the Information Security processes, which include Vulnerability Management, Patch Management on Information Technology devices, Hardening, Information Security Incident Response, Information Security Culture Development and Cyber Threat Intelligence.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K), including, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risks, and reputational risks.

companyName: USA TODAY Co., Inc.

ticker: TDAY


text: Our 'defense in depth' program uses several methods to protect against intrusion by a bad actor, including such techniques as reputational filtering, anti-virus scans, intrusion prevention, multi-factor authentication, and account isolation among others. We also use numerous approaches to detect ransomware and other cyber attacks, including, among others, dark web searches, email sandboxing, endpoint detection, and intrusion detection. The Hartford continues to monitor and enhance its framework to respond to evolving cyber threats and regulations for data privacy, including the European Union General Data Protection Regulation, the California Consumer Privacy Act and the New York Department of Financial Services Cybersecurity Regulation.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: We enlist third-party service providers to support us in conducting information security reviews of our infrastructure, and the evaluation of our company policies. These providers undertake comprehensive evaluations that delineate potential risks, categorized by criticality and associated level of effort. Subsequently, the Company will undertake a meticulous examination of the internal risk register to potentially recalibrate the likelihood of identified risks, taking into consideration the vulnerabilities unearthed by the third-party assessment.

companyName: D-Wave Quantum Inc.

ticker: QBTS


text: The Audit Committee, which is tasked with oversight of certain risk issues, including cybersecurity, receives reports from the Senior Vice President, Global Chief Information Officer and the Vice President, Chief Information Security Officer each quarter. At least annually, the Board of Directors and the Audit Committee also receive updates about the results of exercises and response readiness assessments led by outside advisors who provide a third-party independent assessment of our technical program and our internal response preparedness. The Audit Committee regularly briefs the full Board of Directors on these matters, and the full Board also receives periodic briefings regarding our Information Security Program and cyber threats, including threats faced by our peers, in order to enhance our directors' literacy on cyber issues. In addition, management will update the Audit Committee, as necessary, regarding cybersecurity incidents, that we may experience.

companyName: CHURCH & DWIGHT CO INC /DE/

ticker: CHD


text: In parallel, we are enhancing our third-party cybersecurity and regulatory risk management framework. This includes a structured process for evaluating and monitoring external entities using standardized risk questionnaires, internal knowledge repositories, and validation procedures. These mechanisms are applied both prior to onboarding new suppliers, service providers, or technologies, and as part of periodic reviews of existing third-party relationships. Identify security and compliance gaps early in the vendor lifecycle;

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: Amedisys deploys a range of tools and services, including regular network and endpoint monitoring and vulnerability assessments and penetration testing, to mitigate our cybersecurity-based risks. In addition, we schedule tabletop exercises with management and other employees to evaluate our cyber incident response plans. Amedisys has also received HITRUST certification for our internally developed applications which allows us to baseline our program to industry standards and best practices.

companyName: AMEDISYS INC


text: Role of Management At a management level, our cybersecurity risk management program is led by our CISO. Our current CISO has been with the Company for over 30 years, worked in Information Technology for over 25 years, and has led the Company's security efforts since 2011. He was appointed as the Company's first CISO in 2019. Our CISO stays current on cybersecurity issues and trends through continuing education activities such as participation at conferences and in webinars. Our CISO reports to our Chief Financial Officer. Additionally, our CISO and members of the cybersecurity team hold a number of industry recognized certifications, such as Certified Information Systems Security Professional, Certified Information Security Manager, and Certified Ethical Hacker, among others.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP


text: While cybersecurity threats as a result of any previous cybersecurity incidents have not materially affected our business strategy, results of operations or financial condition, future incidents may interrupt our operations, cause reputational harm, subject us to increased operating costs and/or expose us to litigation. For further discussion of risks related to cybersecurity, see the Risk Factors discussed under "Risks Related to Information Technology".

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: Chevron's Chief Information Security Officer (CISO) leads a global cybersecurity team that operationalizes and manages the company's cybersecurity program and strategy. Chevron's CISO has more than 20 years of cybersecurity experience and is responsible for providing a single and consolidated view of the company's enterprise cybersecurity risk. Before joining Chevron, he held a leadership role in cyber threat analysis with the U.S. Department of State's Bureau of Diplomatic Security. Chevron's CISO reports to the Chief Information Officer (CIO) who is responsible for Chevron's broader IT program, including resiliency and ability to remediate and recover from a cybersecurity incident to minimize impacts to the business and operations. He has more than 30 years of experience in IT and the oil and gas industry.

companyName: CHEVRON CORP

ticker: CVX


text: The Sponsor administers a Third-Party Risk Management Program at the firm to identify, assess and oversee the risk associated with service providers and third parties involved in the supply chain. Third parties are assessed for risk and may additionally be required to adhere to additional security diligence requirements administered with oversight from the CISO according to risk, including cybersecurity diligence questionnaires, evidence validation, SOC report reviews, and/or on-site assessments. Material changes to the program, new, or worsening security risks associated with third parties are reported to the ERC at least quarterly.

companyName: Grayscale Stellar Lumens Trust (XLM)

ticker: GXLM