text: We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on operations and compliance foundations. Operations focus on continuous detection, prevention, measurement, analysis and response to cybersecurity alerts and incidents, and on emerging threats. Compliance establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility and availability of company data stored, processed or transferred. Our cybersecurity program is integrated within our overall risk management processes.

companyName: SOCKET MOBILE, INC.

ticker: SCKT


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include risk assessments of internal and external threats to confidentiality, integrity and availability of the Company's data and systems along with other material risks to firm operations.

companyName: TPG Inc.

ticker: TPG

secItem: Item 1C


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats (including those associated with third-party service providers), and have integrated these processes into our overall enterprise risk management systems and processes. We routinely assess material risks from cybersecurity threats, including taking reasonable steps to detect any potential unauthorized occurrence on or behaviors conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Skillz Inc.

ticker: SKLZ


text: Our Director of Information Technology, Mitch Reszczenski, is primarily responsible for assessing and managing our cybersecurity risks. Mr. Reszczenski has over 29 years of extensive information technology experience in highly successful manufacturing, engineering and financial organizations. Mr. Reszczenski provides regular updates on cybersecurity risks and threats and key developments in Company policies, practices and related risk exposures to the Chief Executive Officer and Chief Financial Officer. Additionally, senior management provides an update to the Board of Directors on cybersecurity matters at least once a year, and more often as appropriate. The Board of Directors annually reviews and approves the capital and operating budgets, ultimately reviewing and approving the amount spent by the Company on cybersecurity measures.

companyName: TAYLOR DEVICES, INC.

ticker: TAYD


text: As part of our monitoring process, we perform tabletop exercises at least annually to test our current plans. These cross-functional exercises involve employees from multiple departments and are designed to gain perspective, collect feedback and validate plan effectiveness. The information obtained from the business impact analysis, exercises and testing is utilized to update contingency plans for each department.

companyName: TACTILE SYSTEMS TECHNOLOGY INC

ticker: TCMD


text: In an effort to effectively prevent, detect, and respond to cybersecurity threats, we employ a multi-layered cybersecurity risk management program supervised by our CIO, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, architecture, and processes. This responsibility includes identifying, considering, and assessing potentially material cybersecurity incidents on an ongoing basis, establishing processes designed to prevent and monitor potential cybersecurity risks, implementing mitigation and remedial measures, and maintaining our cybersecurity program. To do so, our program leverages both internal and external techniques and expertise. Internally, among other things, we may perform penetration tests, internal tests/code reviews, and simulations using cybersecurity professionals to assess vulnerabilities in our information systems and evaluate our cyber defense capabilities. Our cybersecurity capabilities, processes, and other security measures also include, without limitation: • Service Organization Controls ("SOC")-as-a-Service (SOCaas) wherein a third-party vendor operates and maintains a fully-managed SOC on a subscription basis via the cloud; • Security Information and Event Management ("SIEM") software, which provides a threat detection, compliance, and security incident management system; • Endpoint Detection and Response ("EDR") software, which monitors for malicious activities on internal endpoints (e.g., Windows workstations, servers, MAC clients, and Linux endpoints); • Cloud monitoring; and • Disaster recovery and incident response plans, including a ransomware response plan.

companyName: ASBURY AUTOMOTIVE GROUP INC

ticker: ABG


text: Our efforts to create a secure digital environment start with the governance and oversight of our data security and privacy policies and strategy. At the Board of Directors (the "Board") level, cybersecurity is overseen by the Board and by the Board's Audit Committee, which has primary responsibility for overseeing cybersecurity and privacy risks. During fiscal 2024, the Board and/or the Audit Committee received quarterly reports on privacy, data protection and/or cybersecurity matters from senior information technology ("IT") leaders, including our Chief Information Officer ("CIO") and CISO, as well as the Chair of our Data Security and Privacy Governance Committee (discussed below). In addition, our Board held a meeting dedicated to cybersecurity topics. Periodically, our Board receives presentations on cybersecurity matters from third-party cybersecurity experts.

companyName: HOME DEPOT, INC.

ticker: HD


text: The duties and responsibilities of the Audit Committee can be found in the Audit Committee Charter, which is located on our investor relations website. Members of the management team report to the Audit Committee, which reports to the entire Board of Directors about cybersecurity risk at least annually. In addition, in accordance with Rubicon's incident response procedures, the Board of Directors is informed of any potentially material cybersecurity incidents upon discovery and classification of a cyber incident if the incident meets Priority One Status ("P1") and has potential for data loss, loss of service(s) greater than that of any defined service level agreement, or may or does require breach notification. All lower level incidents are reported annually, or as needed to the Audit Committee.

companyName: Rubicon Technologies, Inc.


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We periodically remind and reinforce with our employees the importance of handling and protecting customer and employee data, including through annual privacy and security training designed to enhance awareness of how to prevent, detect, report, and respond to cybersecurity threats. We also conduct periodic phishing training and follow-up with remedial testing and training as necessary.


text: The Company has implemented and maintains an information security incident response plan ("IR Plan"), which includes processes to assess, escalate, contain, investigate, and remediate cybersecurity incidents. Upon notification of a potential cybersecurity threat, management defines the threat based on its nature as an information security event, alert, incident, or breach, and all cybersecurity incidents are categorized by level of severity based on the impact of the incident to the Company's operations. A technical incident response team is responsible for technical response activities, including information gathering and forensic analysis, containment, and remediation efforts. The Company's Crisis Management Team drives the Company's enterprise-level crisis response process, leads decisions around response strategies, coordinates resources required to execute such strategies, and oversees all cybersecurity incidents categorized as Critical and High.

companyName: SONOCO PRODUCTS CO

ticker: SON


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and utilizes common reporting channels and governance processes that apply across other risk areas. While everyone at our company plays a part in managing cybersecurity risks, as discussed in more detail under "Cybersecurity Governance" below, our board of directors, both directly and through delegation to our Audit Committee (the "Audit Committee"), and our senior management team are actively involved in the oversight of our cybersecurity risk management program. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: DOCUSIGN, INC.

ticker: DOCU


text: We have not experienced any material cybersecurity incidents in the past, and we believe no cybersecurity events have occurred that have materially affected the Company or its business strategy, results of operations or financial condition. We continue to invest in the cybersecurity of our infrastructure and the enhancement of our internal controls and processes, which are designed to help protect our systems and data, and the information they contain. We carry insurance in amounts that we believe are reasonable for our business that provides protection against potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover or be sufficient to cover all losses or claims that may arise from a cybersecurity incident.

companyName: RELMADA THERAPEUTICS, INC.

ticker: RLMD


text: The Fund faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. See "Risk Factors – Risks Related to Cybersecurity" for further information on how our operations are subject to cyber incidents that could have a material adverse effect on our business, financial condition, results of operations, and cash flows.

companyName: WTI Fund X, Inc.


text: The Company's IRT serves as the central point for all cybersecurity incidents and reporting, including incidents that directly target associates, customers or the Company's internal information systems and incidents originating from third parties. The IRT evaluates each incident in terms of its impact on the Company's operations, ability to conduct business with customers, reputational risk to the Company, reduce legal risk and the speed and degree to which the incident has been contained. The IRT is also responsible for assessing the nature and scope of the incident, and engaging third-party service providers where appropriate to support the Company through the resolution of the incident. The COO escalates incidents to the Company's IT Steering Committee, who is responsible for cybersecurity risk oversight, and also reports to the Board on a monthly basis.

companyName: Carter Bankshares, Inc.

ticker: CARE


text: In the last two fiscal years, we have not experienced any material cybersecurity breach incidents. For additional information about our cybersecurity risks, please see "Item 1A. Risk Factors – We depend on computer and telecommunications systems, and failures in our systems or cybersecurity attacks could significantly disrupt our business operations."

companyName: NORTHERN OIL & GAS, INC.

ticker: NOG


text: Our systems regularly face attacks that aim to interrupt and delay our operations or obtain information from our systems. Any major disruption or nefarious access, to our systems or a third-party's systems, could lead to disclosure or destruction of data, including employee, customer and corporate information, which may expose us to business, regulatory, litigation and reputation risk and could negatively affect our business and results of operations. As of the date of this Annual Report on Form 10-K, we have not encountered risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial position. Refer to "Item 1A. Risk factors" in this Annual Report on Form 10-K, including "Significant disruptions of information technology systems, breaches of data security, or compromised data could materially adversely affect our business" for additional discussion about cybersecurity-related risks.

companyName: ARKO Corp.

ticker: ARKO


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on its Officers and the expertise of risk management and information technology personnel of Oxford Funds when identifying and overseeing risks from cybersecurity threats, including risks from third parties.

companyName: Oxford Square Capital Corp.

ticker: OXSQ


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function. It has delegated oversight of cybersecurity and other information technology risks to the Audit Committee of the Board of Directors. The Audit Committee oversees the implementation of the cybersecurity risk management program.

companyName: Reborn Coffee, Inc.

ticker: REBN


text: We face a number of cybersecurity risks in connection with our business and have from time-to-time experienced cybersecurity incidents, such as malware infections, phishing campaigns and vulnerability exploit attempts, which to date have not had a material impact on our business strategy, results of operations, or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "A cybersecurity attack, or any other interruption in information technology and/or data security that may impact our operations or the operations of third parties that support us, could adversely affect our business, financial condition and reputation" in Item 1A - Risk Factors.

companyName: BROWN & BROWN, INC.

ticker: BRO


text: Cyber Risks Related to Third Parties Risks from cybersecurity threats associated with our use of third-party service providers or third-party technology or other solutions are addressed as part of our overall cybersecurity risk management program. Before purchasing third party technology or other solutions that involve exposure to the Company's assets and electronic information, our information technology team requires those companies to complete a security review before being approved to work with the Company. To help control cyber risks at third parties and protect customer data and systems on an ongoing basis, we also conduct periodic information security assessments of certain of our third-party service providers.

companyName: ORRSTOWN FINANCIAL SERVICES INC

ticker: ORRF


text: As of November 30, 2024, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations, or financial condition. Despite our efforts with respect to protecting information technology operations and strengthening our cybersecurity and data privacy positions, we have been, and may continue to be, impacted by breaches in data security and lapses in data privacy, which occur from time to time. In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses incurred in connection with cybersecurity incidents were not material. For additional information on the risks from cybersecurity threats and the potential related impacts on the company, refer to Operational Risk Factor f.

companyName: CARNIVAL PLC

ticker: CUK


text: The Audit Committee receives scheduled annual reports from management on our cybersecurity risks, our cybersecurity risk management program and other cybersecurity-related educational topics. In addition, management updates the Audit Committee as necessary, regarding other cybersecurity incidents, including any material cybersecurity incidents.

companyName: Revolution Medicines, Inc.

ticker: RVMD


text: Dana Zeller, Chief Strategic Operations Officer – Ms. Zeller's career has been primarily in bank operations, in which she has participated in end-to-end implementations and upgrades of core banking technology, from selecting a vendor to managing implementations, to leading enhancement and efficiency initiatives throughout the life of the application.

companyName: ConnectOne Bancorp, Inc.

ticker: CNOB


text: The KKR information security team members have a variety of relevant skill sets and expertise. For example, prior to joining KKR, KKR's CISO was the CISO at another large financial institution where he was responsible for their global information security program. KKR's CISO also has prior experience in various information security roles, including security architecture, application security, engineering and operations. He holds a Bachelor of Science in computer science from the New York University Polytechnic School of Engineering, is a Certified Information Systems Security Professional (CISSP) and holds a Series 99 – Operations Professional Exam certification. In addition, KKR information security team members have various backgrounds in information security, including in financial services and critical infrastructure, and the team maintains various levels of certifications – including CISSP, GIAC security operations certification, certified information security manager, and other certifications focused on specific technologies.

companyName: KKR & Co. Inc.

ticker: KKR


text: Our management team, in coordination with our information technology department, is responsible for assessing and managing our material risks from cybersecurity threats and hiring appropriate personnel and third-party consultants to oversee the cybersecurity program. Our VP of Technology Operations and Information Security has primary responsibility for our organization's overall cybersecurity risk management program and supervises our cybersecurity personnel. He has over 25 years of experience driving innovation and security excellence, including design, implementation, and management of cyber-security and information technology programs at various levels and organizations.

companyName: MITEK SYSTEMS INC

ticker: MITK


text: The Information Security organization is led by our CISO. The head of each of the four divisions of our Information Security team reports directly to the CISO. The CISO reports directly to the Company's Chief Information Officer ("CIO"), who is a member of the Company's Senior Management Committee. As a result, all information security personnel report into the CISO, and ultimately the CIO. The CISO also reports indirectly to the Audit Committee of the Board of Directors. Biannually, the CISO reports to the Audit Committee on the cybersecurity risks facing the Company and cybersecurity developments generally. In addition, as discussed above, the Company's Internal Audit team reports to the Audit Committee the results of its annual security audit focused on cybersecurity risks. The Company's Chief Compliance Officer reports key Privacy risk indicators and statistics (including those related to cybersecurity risks) to the Audit Committee on a quarterly basis.

companyName: LINCOLN NATIONAL CORP

ticker: LNC


text: Our Chief Information Officer and General Counsel meet regularly with the Board of Directors and its committees to review relevant areas including: • Key metrics of the information security/cybersecurity program; • The purchase of cybersecurity risk insurance to mitigate exposure to the company; • Monitoring and testing of backup and disaster recovery process; • Cybersecurity incident response and remediation procedures; and • Metrics of the company's training and compliance program on information security and awareness of cyber risk.

companyName: MARCUS CORP

ticker: MCS


text: The Company engages with a number of service providers in connection with normal business operations. The Company uses a variety of processes to address cybersecurity threats related to third-party service providers, including, where appropriate, pre-acquisition diligence, and imposition of contractual data security and privacy obligations. In addition, the Company is a member of an industry cybersecurity intelligence and risk sharing organization and participates in other information sharing groups and trade organizations to stay abreast of ongoing cyber risks, cyber incidents, and newly disclosed vulnerabilities and attack vectors.

companyName: DILLARD'S, INC.

ticker: DDS


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CIO and CISO. Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CIO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing certain security assessments and other security-related reports.

companyName: STARZ ENTERTAINMENT CORP /CN/

ticker: STRZ


text: The foregoing responsibilities are covered on a day-to-day basis by the SVP/IT Manager and ISO. The ISO has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management, including 23 years of cybersecurity experience, 19 of which has been spent at a CPA firm specializing in banking industry financial and information technology audits. The ISO provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Board of Directors.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: The first step in our process is to Identify the risks related to our data, personnel, devices, systems and facilities. In connection with this phase, we do the following: • Perform global risk assessments which include information technology risk areas including cyber and, in conjunction with this assessment, we engage leading security and technology vendors to periodically perform specific technical information technology risk assessments; • Maintain a matrix that delineates roles and responsibilities for information security supporting significant financial applications, database and networks; • Participate in various consortiums, associations and groups allowing us to share threat intelligence and collaborate with organizations across different industries to share best practices, fight cybercrime, enhance privacy, discuss new technologies, better understand the evolving regulatory environment, and advance capabilities in these areas; • Conduct mandatory information security training for all employees and regularly test our employees several times a year for information security awareness and adherence to our information security recommendations; and • Disclose our computer usage policy on our intranet and distribute to new employees.

companyName: FIRST INDUSTRIAL LP


text: We have implemented basic cybersecurity measures, including access controls, secure data storage, and third-party monitoring of our IT infrastructure. Given our lack of operations, we do not anticipate that cybersecurity threats will have a material impact on our financial condition or business strategy. If we pursue an acquisition or commence business operations in the future, we intend to reassess and enhance our cybersecurity risk management framework as necessary.

companyName: RIDGEFIELD ACQUISITION CORP

ticker: RDGA


text: Our management, including our Chief Compliance Officer, is responsible for assessing and managing material risks from cybersecurity threats. Members of our management possess relevant expertise in various disciplines that are key to effectively managing such risks, such as our Chief Financial Officer, who serves as the Chief Information Security Officer of Muzinich & Co. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.

companyName: Muzinich BDC, Inc.


text: Our Chief Information Security Officer ("CISO") is a Certified Information Systems Security Professional and has served in various roles in information security at Charter since 2020. He has over two decades of experience in cybersecurity, corporate security and network operations, including cyber threat intelligence, vulnerability management, security operations, incident response, information security engineering and architecture, risk management and security awareness.

companyName: CHARTER COMMUNICATIONS, INC. /MO/

ticker: CHTR


text: Our processes for assessing and identifying cybersecurity risks include regular network security assessments, vulnerability scans, penetration tests, and audits of our information systems, as well as monitoring and analysis of network activity and threat intelligence. We engage third-party service providers to assist us with some of these activities. We also have processes to oversee and identify cybersecurity risks associated with our use of third-party service providers, such as conducting due diligence, reviewing contracts, and verifying compliance with security standards and best practices.

companyName: COMSTOCK RESOURCES INC

ticker: CRK


text: We are regularly subject to cyberattacks and other cyber incidents. In response, we have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risks. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. Our enterprise risk management team collaborates with our Information Security function, led by the Company's Chief Strategy and Transformation Officer and the Company's Chief Information Security Officer, to gather insights for identifying, assessing and managing cybersecurity threat risks, their severity, and potential mitigations.

companyName: PEPSICO INC

ticker: PEP


text: As part of the above processes, we regularly engage with regulatory examiners, internal and external auditors, and other third-parties, as well as a regular review by both our technology risk management team and corporate risk management team to help identify areas for continued focus, improvement and/or compliance.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: As part of our Board of Directors', or Board's, enterprise risk management program, our Board has responsibility for oversight of cybersecurity risk management. Our Board has delegated to our Audit Committee oversight of our cybersecurity risk management program, including oversight of information security and cybersecurity threats and related compliance and disclosure requirements. On an annual basis, our Head of IT and vCISO provide an update to our Audit Committee regarding our cybersecurity risk management program, including as relates to critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards. The Audit Committee periodically reports on cybersecurity risk management to the full Board of Directors.

companyName: CRISPR Therapeutics AG

ticker: CRSP


text: The Company's cybersecurity team, which is led by our CISO, is responsible for overseeing the Company's cybersecurity and data security operations, programs, policies and processes and their general effectiveness. The cybersecurity team, in coordination with other Incident Response Team members, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incident. The Company's Incident Response Team consists of our CISO and other senior leaders from the Company's cybersecurity (composed of information security and technology operations), compliance, legal, financial reporting and other key business and corporate functions. The CISO and other Incident Response Team members monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with the incident response plan. The team also informs and coordinates with the Company's Disclosure Committee in timely reporting such incidents, as appropriate and depending on the severity of the incident, to the Strategy Board (consisting of our CEO, Chief Financial Officer (CFO), General Counsel, CIO and other members of management), Audit Committee and Board, and providing updates regarding such incidents until addressed.

companyName: PHINIA INC.

ticker: PHIN


text: General and Other Risk Factors • the adequacy and availability of, and ability to obtain, insurance coverage, customer indemnifications or other liability protections • the future investment performance of plan assets, gains or losses associated with changes in valuation of marketable securities related to our non-qualified benefit plans, changes in actuarial assumptions associated with our pension and other postretirement benefit plans and legislative or other regulatory actions impacting our pension and postretirement benefit obligations • changes in business conditions that could impact business investments and/or recorded goodwill or the value of other long-lived assets, and other potential future liabilities You are urged to consider the limitations on, and risks associated with, forward-looking statements and not unduly rely on the accuracy of forward-looking statements. These forward-looking statements speak only as of the date this report is first filed or, in the case of any document incorporated by reference, the date of that document. We undertake no obligation to publicly update or revise any forward-looking statements, whether as a result of new information, future events or otherwise, except as required by applicable law.

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: Risk Management and Strategy face various cyber risks, including, but not limited to, risks related to unauthorized access, misuse, data theft, computer viruses, system disruptions, ransomware, malicious software and other intrusions. We utilize a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cyber and information security threats through our cybersecurity risk management program. Our cybersecurity risk management program is designed to identify, assess, prioritize and mitigate risks across the organization to enhance our resilience and support the achievement of our strategic objectives. This integrated approach helps ensure that cyber risks are not viewed in isolation, but are assessed, prioritized and managed in alignment with the Company's operational, financial and strategic risks, assisting the Company in more effectively managing interdependencies among risks and enhancing risk mitigation strategies.

companyName: NETSOL TECHNOLOGIES INC

ticker: NTWK


text: The Cybersecurity Incident Response Plan was developed to respond to cybersecurity incidents. A cybersecurity incident starts with malicious intent and can include, but is not limited to, disruptions of service, denials-of-service, compromises of information systems, data exfiltration or data corruption. The plan provides a streamlined approach that includes enterprise-level response plans. The plans can be invoked rapidly to address matters that raise enterprise concern and to communicate impact, actions, and status to senior management, including the Chief Information Security Officer (CISO), and appropriate stakeholders, including escalation to appropriate Board-level governance committees, and is reviewed, tested, and updated regularly.

companyName: NORTHERN TRUST CORP

ticker: NTRS


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Senior Vice President, Corporate Operations and Legal. The Senior Vice President, Corporate Operations and Legal works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Kronos Bio, Inc.


text: Threat Intelligence The Company considers threat intelligence from third party sources to strengthen systems and network preparedness for cybersecurity risks. The Company uses associations, such as the Financial Services Information Sharing and Analysis Center ("FS-ISAC"), to stay informed of threat information.

companyName: BANCFIRST CORP /OK/

ticker: BANF


text: We use third party service providers to perform information systems and security services, such as developing a vendor management program to manage cybersecurity risks associated with our use of certain vendors. The program includes a review of the security controls and processes used by our vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the service provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a vendor and impose contractual obligations related to data security on the vendor.

companyName: LUMOS PHARMA, INC.


text: Our chief information officer ("CIO"), chief information security officer ("CISO") and chief technology officer ("CTO") have primary responsibility for assessing and managing material cybersecurity risks. Through the ongoing assessments they perform, including third-party assessments, they make recommendations on enhancing the security controls, and the continued maturity of our information technology and information assurance programs.

companyName: WASHINGTON TRUST BANCORP INC

ticker: WASH


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team (and team personnel who support our information security program) has primary responsibility for our overall cybersecurity program and supervises both our internal cybersecurity personnel and our retained external cybersecurity third party vendors and consultants. In addition, our team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal personnel, threat intelligence and other information obtained from governmental, public or private sources, including external vendors and consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment. The team is led by our Vice President - Software, Engineering, and IT, who also currently serves as our Interim Chief Information and Security Officer, and has over 24 years of industry experience leading IT for organizations of similar sizes. Team personnel who support our information security program have relevant educational and industry experience, including holding similar positions at previous large companies and government entities.

companyName: Beauty Health Co

ticker: SKIN


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our IT Assets, which include implementing policies and guidelines governing the individual use and protection of IT Assets by employees, employee training, and leveraging the capability of third -party service providers to support our internal cybersecurity processes. These processes are aligned with standard industry frameworks, such as the National Institute of Standards and Technology, Committee of Sponsoring Organizations, International Organization for Standardization 27001, and other industry standards. We have also implemented a well-established information security incident response plan, which is designed to escalate cybersecurity incidents, depending on the circumstances, to appropriate stakeholders as defined by internal standard operating procedures. We continue to monitor proposed cybersecurity disclosure rules from the SEC and alter our procedures accordingly.

companyName: TG THERAPEUTICS, INC.

ticker: TGTX


text: Education and Awareness We provide cybersecurity training for all directors, officers and employees and periodic additional training of senior management through our cyber insurance carrier.

companyName: OMEGA HEALTHCARE INVESTORS INC

ticker: OHI


text: In 2023, we did not identify any privacy or cybersecurity threats that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: AvePoint, Inc.

ticker: AVPT


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, management and the Audit Committee oversee cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Theriva's management team is responsible for oversight and administration of cybersecurity risk management strategies, and for informing the Board and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.

companyName: Theriva Biologics, Inc.

ticker: TOVX


text: To combat the ever-present cyber risks, the Company maintains a comprehensive ISP, which includes continuous risk assessments, an Incident Response Plan, and a multilayered control environment meant to protect, detect, respond to, and limit unauthorized or harmful actions across our information environment. The control environment is based off industry leading recommendations, including the Center for Internet Security (CIS) Critical Security Controls and the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). Our Information Security Officer (ISO) is primarily responsible for coordinating the various aspects of the ISP with cross-functional support teams across various teams within the Company.

companyName: Merchants Bancorp

ticker: MBIN


text: The CTO has served in various roles in technology for over 25 years and in information security including product security for over a decade. The CTO holds a PhD in engineering and degrees in technology and management. The CISO has served in various roles in information technology and information security for over 25 years, including serving as a cybersecurity leader for public companies for over a decade. The CISO holds a degree in engineering and a master's degree in business.

companyName: nVent Electric plc

ticker: NVT


text: Industry standards such as the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity inform our program and are the basis of our compliance commitment. Regular maturity assessments, conducted by external experts, ensure that our cybersecurity program remains at the forefront of industry best practices, tailored to our unique operational landscape.

companyName: Barnes & Noble Education, Inc.

ticker: BNED


text: Our inability to operate, payment of damages, payment of ransom, and the costs of reparation of our systems, consultants and tangential expenses will all result in damage to our business and our financial resources.

companyName: MDB Capital Holdings, LLC

ticker: MDBH


text: Material Impact from Cybersecurity Threats At the time of filing of this Annual Report on Form 10-K, to our knowledge, we have not experienced any cybersecurity threats that have materially affected our company (or are reasonably likely to materially affect our company), including our business strategy, operations or financial condition. For more information regarding cybersecurity risks faced by our company, see Item 1A. Risk Factors—Factors Relating to Cybersecurity—Factors Relating to Cybersecurity, which are incorporated by reference into this section.

companyName: Liberty Latin America Ltd.

ticker: LILA


text: We are a blank check company with no business operations. Since the IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates.

companyName: Chenghe Acquisition II Co.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. The Audit Committee of our Board of Directors is responsible for the oversight of risks from cybersecurity threats.

companyName: ASPEN AEROGELS INC

ticker: ASPN


text: We have developed cybersecurity risk management processes to identify, manage, and prevent risks related to cybersecurity. Our Information Technology ("IT") team manages our cybersecurity program and the security measures and processes we have in place.

companyName: UNIVERSAL ELECTRONICS INC

ticker: UEIC


text: Board of Directors has three members with skills and experience in information security and cybersecurity through their experience as current and former executives of digital technology companies.

companyName: OptimizeRx Corp

ticker: OPRX


text: Northfield Bank maintains an Information and Cybersecurity Program under the leadership of our Chief Risk Officer, the Chief Information Officer, and the Chief Information Security Officer, with timely Board oversight for identifying and mitigating information security risks. The Information Security Department is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats and overseeing cybersecurity vendors. The Information Security Department is led by our Chief Information Security Officer ("CISO"). Our immediate past CISO had over 15 years of experience in the cybersecurity space and has obtained professional security certifications and advanced training in the field of cybersecurity and technology. Northfield Bank is currently onboarding a new CISO, who comes to us from a money center bank and has a similar background. Our Chief Information Security Officer and our Chief Information Officer, along with key members of their departments, regularly collaborate with peer institutions, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions. Our internal audit team, led by our Chief Internal Auditor, provides independent assurance and evaluation of processes, controls and cybersecurity risk management practices to ensure they are adequate and functioning as intended.

companyName: Northfield Bancorp, Inc.

ticker: NFBK


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to help maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. This includes processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers and maintaining a cyber incident response plan designed to assist us in identifying, responding to and recovering from cybersecurity incidents. We utilize third parties to assess the effectiveness of our cybersecurity program on a periodic basis. This includes cybersecurity assessors and cybersecurity experts to assist in the identification, verification, and validation of material risks from cybersecurity threats, as well as to support associated mitigation plans when necessary.

companyName: Beneficient

ticker: BENF


text: Our head of IT, cybersecurity manager, and other members of our cybersecurity team provide quarterly updates and reports to the Governance Committee of our Board of Directors on cybersecurity risks and our risk management systems. Our cybersecurity team is also required to provide senior management and the Governance Committee with more frequent updates on major developments regarding cybersecurity matters or as otherwise appropriate. As noted above, the Governance Committee provides regular updates to the Board on these matters so that the Board remains adequately informed about this important aspect of the Company's overall risk management.

companyName: NEOGEN CORP

ticker: NEOG


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit and Risk Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Four Corners Property Trust, Inc.

ticker: FCPT


text: For additional information regarding cybersecurity risks and their potential impacts on our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A. Risk Factors in this Annual Report, including the risk factor captioned "We and the third parties with whom we work are subject to stringent and changing privacy, data protection, and information security laws, contractual obligations, self-regulatory schemes, government regulation, industry standards and other obligations related to data privacy and security. The actual or perceived failure by us or the third parties with whom we work to comply with such obligations could result in harm to our reputation, regulatory investigations or actions, significant fines and liability, disruption of our clinical trials or other material adverse effects on our business."

companyName: Immunovant, Inc.

ticker: IMVT


text: Our cybersecurity risk management program is designed to be aligned with our business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational and financial risk. Key elements of our cybersecurity risk management program include: • periodic risk assessments designed to help identify cybersecurity risks to our critical systems, information, products, services and our broader enterprise information technology environment; • a security and infrastructure team principally responsible for managing our cybersecurity risk assessment processes, our security controls and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • employee training and awareness programs that include periodic and ongoing assessments in an effort to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • processes to evaluate cybersecurity risks posed by critical third -party vendors, including through the use of security questionnaires.

companyName: WisdomTree, Inc.

ticker: WT


text: While the Information Security Program is reasonably designed to mitigate the risk of cybersecurity events, we cannot provide assurance that we will not be subject to a cybersecurity event. In "Item 1A. Risk Factors," see "We could incur significant liability or reputational harm if the security of our information technology systems, or of our third-party vendors or service providers, is breached, including as result of a cyberattack, or we otherwise fail to protect confidential information, including personally identifiable information that we maintain."

companyName: RADIAN GROUP INC

ticker: RDN


text: Our Board as a whole has oversight for the most significant risks facing us and for our processes to help identify, prioritize, assess, manage, and mitigate those risks, including oversight of cybersecurity risks. Our Board receives at least two updates each year on cybersecurity and information technology matters and related risk exposures from our Head of IT as well as other members of our senior leadership team.

companyName: Protagonist Therapeutics, Inc

ticker: PTGX


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, vulnerability management and disaster recovery policies, risk assessments, data encryption and data segregation of certain data, access controls and network security controls in certain environments, physical security controls, employee training, penetration testing, systems monitoring, cybersecurity insurance and asset and vendor management programs.

companyName: NeuroPace Inc

ticker: NPCE


text: Information, unlike other assets such as cash, facilities, equipment, and products, is highly volatile in terms of its value and many people can use it simultaneously. It leaves no obvious indicators when it is stolen, and it is in constant motion across our internet, intranet, extranet, and computer systems. It is often stored in many locations in different formats at the same time. These characteristics make it much more difficult to manage, control, and protect than other types of assets and therefore a risk management process is required. Our cybersecurity policies and procedures have been developed to ensure an adequate and consistent approach to the management, control, and protection of our information ("Information Assets"). Our Information Assets include business information, customer information and external business partner information, including, without limitation, classified information, information relating to research, intellectual property, personally identifiable information, business and product development, clinical test and evaluation data, and business plans, customer and supplier information, supply chain, manufacturing, distribution, finance, human resources, consulting, partnerships, contracts, and corporate transactions, maintained in any form or format or location, including audio, video, paper, magnetic, electronic and optical. Information Assets may be classified as Low, Medium, or High Risk based on the potential impact of its unauthorized disclosure.

companyName: Clene Inc.

ticker: CLNN


text: We maintain an updated inventory of critical digital assets and leverage internal assessments and external threat intelligence to monitor and protect against emerging threats. We conduct periodic scans and audits identify vulnerabilities in our systems.

companyName: Armlogi Holding Corp.

ticker: BTOC


text: We are committed to ensuring the confidentiality, integrity and availability of data that is owned and managed by us. We are also committed to protecting confidential information that is shared with us by our business partners. The cybersecurity program at Koppers has been designed based on an industry standard cybersecurity framework and is aligned with local and regional compliance requirements. The cybersecurity program is reviewed periodically by an independent third-party, and the results are shared with the board of directors. Components of the cybersecurity program are guided by the results of the independent third-party assessment. The cybersecurity program is part of the larger Enterprise Risk Management (ERM) program which is reviewed by management and the board of directors on a periodic basis. Compliance with the cybersecurity program is ensured via policies, procedures, training, and systems.

companyName: Koppers Holdings Inc.

ticker: KOP


text: The Company engages external parties, including consultants, computer security firms and risk management and governance experts, to enhance its cybersecurity oversight. In order to oversee and identify risks from cybersecurity threats associated with the Company's use of third-party service providers, we also have a third-party risk management program designed to help protect against the misuse of information technology by third parties and business partners, which includes certification of our major technology suppliers and any outsourced services through accepted security certification standards.

companyName: HERSHEY CO

ticker: HSY


text: Our employees play a vital role in protecting our and our clients' data. We provide regular, mandatory training for our employees regarding cybersecurity threats to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. The traditional requirement for associate cybersecurity training is complemented by frequent security education and awareness campaigns. Each month, we feature a different security topic such as data loss prevention, phishing and ransomware. We also maintain a third-party risk management program to identify, assess, mitigate and monitor risks associated with third parties' software and services that we utilize.

companyName: FISERV INC

ticker: FISV


text: Based on our small size (two employees and two consultants), we rely extensively on information technology systems managed by third party major service providers to securely process, store and transmit our data to conduct business. Our employees and consultants utilize end point security tools, such as firewalls and anti-virus protection, to protect our data. We have recently implemented overall risk procedures which incorporate certain uniform processes. To date, we have not engaged any consultants, auditors or other third parties in connection with our risk management system or processes.

companyName: NETWORK-1 TECHNOLOGIES, INC.

ticker: NTIP


text: Cybersecurity risk management forms part of our overall risk management framework, which is regularly reviewed by our Chief Technology Officer ("CTO"), our senior management team and our Board of Directors. We retain an ISO 27001:2013 certification related to our information security management system ("ISMS") that supports the assets, technologies, personnel, and processes used by our corporate IT environment, as well as the satellite command and control, data uplink and downlink pipelines, and ground stations utilized by our radio frequency collection and data products. Cybersecurity incident response procedures are enumerated in internal policies and procedures with remediation plans reflective of the scope and severity of the incident. This remediation typically involves incident analysis, incident isolation and eradication, and post-incident response. In the event a cybersecurity incident is detected, the IT Security Team reports the event to our legal and compliance teams. These Legal and Compliance professionals then advise on any additional notification or reporting requirements.

companyName: Spire Global, Inc.

ticker: SPIR


text: Under our Shared Services Agreement with D.R. Horton, D.R. Horton provides us with certain administrative and compliance services which includes information technology, internal audit and information technology risk services. Leveraging these services provided by D.R. Horton related to cybersecurity, we have processes in place for assessing, identifying, and managing risks from cybersecurity threats that may result in material adverse effects to the confidentiality, integrity and availability of our systems, operations and data. These processes are a part of our overall risk assessment process. Risks from cybersecurity threats include, among other things, unauthorized access, data theft, computer viruses, ransomware, malicious software and other disruptions. We have implemented systems and processes utilizing a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cybersecurity threats. Each of these layers contain multiple levels of protection and leverage industry standard framework including the National Institute of Standards and Technology (NIST) Cybersecurity Framework. At the management level, these systems and processes are overseen primarily by the D.R. Horton Chief Information Officer (CIO) and Cyber Security Risk Officer (CSRO).

companyName: Forestar Group Inc.

ticker: FOR


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, administrative functions, customer service, product development, and competitive position. They might also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share.

companyName: Magnera Corp

ticker: MAGN


text: We actively enhance our cybersecurity program through testing by third-party assessors and measure the results against industry standards. We also have standing engagements with incident response experts and external counsel to provide timely support to our incident response capabilities, and we regularly engage with external experts to analyze the threat landscape.

companyName: TPI COMPOSITES, INC

ticker: TPICQ


text: The TORC, an executive management committee, assesses and manages the effectiveness of our cybersecurity program, which is overseen by the TOPS of our Board. The TOPS receives regular cybersecurity updates throughout the year and is responsible for reviewing and approving the cybersecurity policy on an annual basis. We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition.

companyName: STATE STREET CORP

ticker: STT


text: Like most organizations, we and our third-party service providers have experienced and expect to continue to experience actual or attempted cyber-attacks of our information systems and networks. During the reporting period, Griffon has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operating results, and financial condition. However, if any such event, whether actual or perceived, were to occur, it could have a material adverse effect on our business strategy, operating results and financial condition. We continuously use threat models and cyber threat intelligence to identify relevant risks to our businesses and take active measures to mitigate these risks. For more information regarding the risks we face from cybersecurity threats, see Item 1A., "Risk Factors" in this Annual Report on Form 10-K.

companyName: GRIFFON CORP

ticker: GFF


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and other applicable industry standards. In connection with our information security program, we perform ongoing internal and external risk assessment activities, and deploy systems, processes, and procedures across our global business units in response to identified risks. As cybersecurity events are detected via our global processes, the potential impact of the events are assessed using a variety of methods, and our incident response plan is enacted as needed. The incident response plan is periodically evaluated by our cybersecurity team as well as by independent advisors using simulated security events. Security awareness training is also key component of our information security program and involves required training for all our teammates.

companyName: GENUINE PARTS CO

ticker: GPC


text: We leverage a multi-layered strategy that is designed to assess, identify, manage and mitigate risks to our systems and data from cybersecurity threats. Proactively, we have implemented numerous threat management tools and processes. In addition, we have disaster recovery and business continuity plans that are tested and updated periodically. We strive to stay abreast of cybersecurity threats through integrated threat intelligence feeds, industry and federal threat notices, and participation in healthcare industry intelligence sharing. We also conduct table-top exercises, which serve to simulate cybersecurity incidents to practice response and identify gaps, on a regular basis. Our internal audit team performs random sampling audits of security practices at our facilities, and we routinely perform security risk assessments.

companyName: TENET HEALTHCARE CORP

ticker: THC


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on Bain Capital's Vendor Risk Management Program in conjunction with a Third Party Risk Management (TPRM) steering committee to assess risks posed when engaging with external vendors and/or third parties, including identifying and overseeing risks from cybersecurity threats associated with the Company's use of such entities.

companyName: Bain Capital Specialty Finance, Inc.

ticker: BCSF


text: Our Information Security Officer has 24 years of experience working for financial institutions and has served in the role of Chief Information Officer and Chief Information Security Officer. He is a certified and active Certified Information Security Manager ("CISM") professional. Our Information Security Officer is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The department, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, our Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.

companyName: SMARTFINANCIAL INC.

ticker: SMBK


text: The board of directors' audit and risk committee receives annual reports from our Head of IT, concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit and risk committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: Silence Therapeutics plc

ticker: SLN


text: Annual network and penetration testing by reputable third-parties to evaluate the Company's suite of security controls and tools, and identify potential vulnerabilities. Regular cybersecurity and information security awareness training for associates, supplemented with recurring social engineering tests.

companyName: National Bank Holdings Corp

ticker: NBHC


text: Since 2018 the Company has been primarily focused on pursuing FDA Pre-Market Approval (PMA) for its CelluSTAT products to enable it to access the Class III surgical markets and has de-emphasized its commercial operations. We have fewer than 10 employees and consultants and currently use third-party vendors and service providers for certain product development and regulatory approval activities. Most of the information generated and collected by the Company is stored and maintained by these third-party vendors and service providers. Each of these providers has demonstrated its own cybersecurity protocols which our management believes to be adequate for protecting the Company's digital files in their possession. Our CEO (who is also one of the Company's directors) and VP of Finance are responsible for assessing and managing cybersecurity risks. Neither of them have cybersecurity expertise. Due to the current small size and limited commercial operations of the Company, we have no formal cybersecurity policies and processes in place, however, the Board and management believe cybersecurity represents an important component of the Company's overall approach to risk management and oversight.

companyName: United Health Products, Inc.

ticker: UEEC


text: To our knowledge, we have not had a cybersecurity incident that has materially affected Quaint Oak Bancorp, its business strategy, financial condition, or results of operation.

companyName: QUAINT OAK BANCORP, INC.

ticker: QNTO


text: Cohen & Steers also uses third-party service providers to perform a variety of functions throughout its business, such as application providers, hosting companies and supply chain resources. Cohen & Steers maintains a risk-based approach to identifying and overseeing cybersecurity risks and vulnerabilities presented by its engagement of third parties, as well as the information systems of third parties that could adversely impact its business in the event of a cybersecurity incident affecting those third-party systems. Cohen & Steers' vendor risk management program may involve different assessments designed to help identify cybersecurity risks including: (i) vendor risk assessments; (ii) security questionnaires; (iii) vendor audits; (iv) vulnerability scans relating to vendors; (v) security assessment calls with the vendor's security personnel and its review of the vendor's written security program, security assessments and other reports; (vi) evidence of cybersecurity preparedness through a System and Organization Controls ("SOC") 1 or SOC 2 report; and (vii) the imposition of contractual obligations on the vendor.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: The Company continues to make cybersecurity a priority as the threat landscape evolves and becomes increasingly complex and sophisticated.

companyName: EAGLE MATERIALS INC

ticker: EXP


text: Our Chief Digital and Information Officer, who holds a bachelor's degree in computer science, has over 30 years of experience at multinational companies, including seven years of service at Ingredion in his current position as a digital leader and executive, which includes experience managing and responding to cybersecurity risks. Our Senior Director, Global Information Security, who has over two decades of service at multinational companies and a federal government agency, including over two years of service at Ingredion in his current position dedicated to information technology and cybersecurity, possesses significant experience in protecting critical data and building cybersecurity-resilient organizations. He holds a bachelor's degree in telecommunications management and a master's degree in cybersecurity, as well as a current Certified Information Systems Security Professional ("CISSP") certification.

companyName: Ingredion Inc

ticker: INGR


text: Management regularly communicates with the Greystone affiliate regarding the information technology managed services system including ongoing threats or cybersecurity incidents, monitoring of third-party vendors used by the Greystone affiliate, and review of System and Organization Controls assurance reports. Risk management processes in place at the Greystone affiliate include an annual cybersecurity risk assessment, third-party network security assessments, continuous employee training, regular internal information technology audits, and ongoing threat monitoring.

companyName: Greystone Housing Impact Investors LP

ticker: GHI


text: The Board of Trustees and Advisor are aware that preventive measures cannot prevent all cyber incidents. When a cyber incident occurs, our actions are guided by an incident response plan decision tree to (i) detect, contain and eradicate any threats, (ii) assess materiality, (iii) notify internal parties, (iv) recover any compromised data and information systems, (v) limit impacts of any such incident on the Trust's operations, and (vi) report any such incident as required by law or as otherwise necessary.

companyName: Sterling Real Estate Trust


text: Cyber Risk Management and Strategy We have a process in place for assessing, identifying, and managing material risks from cybersecurity threats. This process is integrated into the Company's overall risk management framework, as overseen by the Company's Board of Directors.

companyName: CareMax, Inc.


text: The TDS information security program is based on a defense-in-depth approach and aligns with the National Institute of Standards and Technology (NIST) cybersecurity framework. Security control and maturity assessments are conducted periodically leveraging this standard. TDS also leverages internal and external auditors and consultants to perform independent assessments and tests of security controls. The assessment results are used to drive continuous improvement in the TDS cybersecurity control environment, as well as to manage potential data security risks of third-party service providers.

companyName: TELEPHONE & DATA SYSTEMS INC /DE/

ticker: TDS


text: Real-Time Monitoring. We engage a third -party security operations center that actively monitors our environment and detects and remediates security threats in real-time.

companyName: Clene Inc.

ticker: CLNN


text: Notwithstanding our vigilant cybersecurity program, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For further information, refer to Section 1A, Risk Factors, for a discussion of risks related to cybersecurity and technology.

companyName: BRUNSWICK CORP

ticker: BC


text: We recognize the critical importance of maintaining the trust and confidence of business partners, employees and patients, toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the UK governments' National Cyber Security Centre and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: The Company employs a variety of security-focused training/awareness practices to equip the Company's personnel with effective tools to address cybersecurity threats. Information Technology ("IT") and cybersecurity-based training is performed during employee on-boarding to communicate the Company's evolving information security policies, standards, processes and practices. Phishing simulations are performed on a monthly basis and Company-wide notifications and/or cyber awareness messages are sent on an as-needed basis. The Audit Committee also surveys data and factors that impact costs and incident response efforts.

companyName: WABASH NATIONAL Corp

ticker: WNC


text: Stewart receives certain confidential or personal information related to its customers and employees. Stewart's operations depend upon the secure collection, processing, retention and transmission of such information by and through Stewart and its vendors. Therefore, the performance, reliability, and security of Stewart's technology infrastructure and information systems, and those of its vendors, are critical to Stewart's operations and initiatives.

companyName: STEWART INFORMATION SERVICES CORP

ticker: STC


text: The Enterprise Risk Management Committee oversees cybersecurity risks Company-wide while the Company's Chief Technology Officer ("CTO"), a member of the Enterprise Risk Management Committee, oversees the Information Security business unit's cybersecurity management programs and activities. The Company's cybersecurity risk management program includes the following key elements: • formal cybersecurity risk assessment designed to help identify material cybersecurity risks to the Company's critical systems, information, services, and its broader enterprise information technology environment led by the Company's Information Security business unit and reported to its Enterprise Risk Management Committee; • a team comprised of information security, information technology, infrastructure, and compliance personnel responsible for directing the Company's cybersecurity risk assessment and security processes and its cybersecurity incident response; • third-party cybersecurity service provider, as needed, to conduct independent review and testing of the Company's cybersecurity risks and report to the Company; • systems for protecting information technology systems and monitoring for suspicious events, such as threat protection, firewall and anti-virus software; • cybersecurity awareness and prevention training for all employees; • a Security Incident Response Plan designed to respond to cybersecurity incidents, which is regularly tested; • a Vendor Risk Management Process for vetting third party service providers with access to the Company's information technology systems.

companyName: MERCURY GENERAL CORP

ticker: MCY


text: December 31, 2023 Our Trustees consider cybersecurity risk as part of its risk oversight function. Our Trustees oversee management's implementation of our cybersecurity risk management program. Our Trustees will receive periodic reports from management on our cybersecurity risks as well as updates, as necessary, regarding any significant cybersecurity incidents impacting our advisor's information systems.

companyName: LUB LIQUIDATING TRUST


text: The Board regularly reviews our cybersecurity and other technology risks, controls and procedures. The Board receives reports from our Chief Executive Officer and Chief Information Officer at least twice annually regarding our cybersecurity framework, as well as our plans to mitigate cybersecurity risks and to respond to any data breaches. In addition, our cybersecurity infrastructure is overseen by our Chief Information Security Officer, who reports to our Chief Information Officer. Our Chief Information Security Officer has served in various roles in information technology and information security for over 20 years, including most recently leading the information security function of McCormick & Company. He holds a Ph. D. in information assurance & security, along with industry certifications that include ISACA Certified Data Privacy Solutions Engineer and Certified Information Security Manager and EC-Council's Certified Chief Information Security Officer certification. Our Chief Information Officer reports to our Chief Executive Officer and has served in various roles in information technology and information security for over 25 years, including as head of enterprise architecture for VF Corporation. Our Chief Information Officer holds an MBA along with various industry certifications, including SAP Enterprise Architect certification and TOGAF certification.

companyName: Hanesbrands Inc.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Advisor.

companyName: Kennedy Lewis Capital Co


text: Our internal cybersecurity professional reports to our CEO and is responsible for assessing and managing our material risks from cybersecurity threats. The CEO is supported by our Chief Legal Officer in exercising primary oversight for our overall cybersecurity risk management program.

companyName: AN2 Therapeutics, Inc.

ticker: ANTX


text: We foster a shared responsibility for the Company's cybersecurity with all our employees, conducting periodic phishing simulation campaigns and providing regular, mandatory security awareness training to enhance awareness and readiness against cyber threats. Certain roles require additional role-based, specialized cybersecurity training. To protect our data and information systems, we maintain Company-wide cybersecurity policies and procedures regarding encryption standards, malware protection, remote access, multifactor authentication, confidential information, and internet, social media, email, and wireless device usage. The CISO and IT team review and update such policies and procedures to adapt to evolving cybersecurity landscapes, industry best practices, and regulatory and statutory updates. Our CISO conducts thorough reviews of these updates at least annually to ensure their continued relevance and effectiveness in safeguarding the Company's assets and business interests.

companyName: Maiden Holdings, Ltd.

ticker: MHLA


text: We have developed and maintained policies, procedures, and controls to mitigate material risks from cybersecurity threats, and assess and disclose information to investors concerning material cybersecurity incidents. Further, we have strategically integrated cybersecurity risk management into our broader risk management framework to promote awareness and attention to cybersecurity risk management company wide. These risks are evaluated on an ongoing basis as part of our overall risk management strategy that is monitored and tracked by our Risk and Information Security Committee, as well as through a separate cybersecurity assessment of the China IT platform operated by our contractually controlled subsidiary, JiuGe Technology, which is required under PRC laws. The lead information technology manager (the "IT Manager")

companyName: FingerMotion, Inc.

ticker: FNGR


text: Managing Material Risks & Integrated Overall Risk Management The Company has integrated cybersecurity risk management into its broader risk management framework in order to promote a culture that values protecting sensitive information. This integration is intended to promote the inclusion of cybersecurity considerations in decision-making processes throughout the Company. As the operating company, the Bank's general risk management personnel, including the Chief Risk Officer ("CRO"), work closely with their information technology and security counterparts to evaluate and address cybersecurity threats in alignment with our business objectives and operational needs.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: The audit committee of our Board is responsible for oversight of risks from cybersecurity threats. The Information Technology Director presents an update on cybersecurity risk management to the audit committee of our Board during quarterly meetings and the audit committee reports to the Board.

companyName: ProPetro Holding Corp.

ticker: PUMP


text: Our Chief Technology Officer has served in the role since 2008, and has more than 15 years of experience in developing and executing large enterprise data privacy and cyber security roadmaps at publicly-traded companies. He holds undergraduate and graduate degrees in engineering. Our Vice President, Information Technology, has served in the role since 2003, and has more than 35 years of cybersecurity experience. He holds an undergraduate degree in computer science.

companyName: LENNOX INTERNATIONAL INC

ticker: LII


text: Our Board, supported by the ITBC and the ITSC, actively oversees our processes for management of cybersecurity risks and threats. The Board's responsibilities include the ongoing administration of the ISP, conducting an annual review, and granting approval. Regular reviews of reports by both the Board and the ITBC, submitted by the ITSC, ensure timely awareness of emerging concerns and facilitate continuous enhancements to our cybersecurity posture. In addition to governance oversight, the Board designates key roles crucial for effective cybersecurity management. This includes appointing the Information Security Officer ("ISO"), Chief Information Officer ("CIO"), and Chief Compliance Officer ("CCO"). The ISO and CIO roles are filled jointly by one individual, who has been with the organization for 20 years with over 25 years of experience in information technology. Our Chief Compliance Officer has been with the organization for over 37 years, with over 15 years of experience in compliance. These professionals bring diverse qualifications, certifications, and experience, ensuring a comprehensive approach to our information security initiatives. These qualifications and certifications include Certified Information Security Manager (CISM) and Certified Banking Security Manager (CBSM).

companyName: Richmond Mutual Bancorporation, Inc.

ticker: RMBI


text: We also have a Technology Steering Committee that assists with fulfilling oversight responsibilities of information technology risks, including cybersecurity risks. The Technology Steering Committee is comprised of our executive officers and relevant business leaders from the information security, information technology, legal, human resources, audit, finance, communication and risk functions, and identifies, defines, manages and measures information technology and cybersecurity risks applicable to us on an enterprise level. The Technology Steering Committee meets quarterly, and reviews all cybersecurity risks and incidents meeting certain criteria, and provides oversight with respect to cybersecurity matters at a management level. Further, the Technology Steering Committee reviews management's information security risk management program controls meeting certain criteria.

companyName: CoreCivic, Inc.

ticker: CXW


text: With respect to incident response, the Company has adopted a Cybersecurity Incident Response Plan, as well as a Data Privacy Incident Response Plan that applies if customer information has been compromised (together, the "IRPs"), to provide a common framework for responding to security incidents. This framework establishes procedures for identifying, validating, categorizing, documenting and responding to security events that are identified by or reported to the CSO. The IRPs apply to all AT&T personnel (including contractors and partners) that perform functions or services that require securing AT&T information and computing assets, and to all devices and network services that are owned or managed by the Company.

companyName: AT&T INC.

ticker: T


text: Risk Management and Strategy Rhinebeck Bank recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Cybersecurity risk management is an integral part of our overall enterprise risk management program. As a financial services company, cyber threats are ever present and growing, and the potential exists for a cybersecurity incident disrupting business operations and compromising sensitive data. Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and the potential of cyber threats. Our objective for managing cybersecurity risk is to avoid or minimize the impact of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the Federal Financial Institutions Examination Council Cybersecurity Guidelines, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits and threat intelligence feeds to facilitate and promote program effectiveness. We continuously monitor evolving regulatory requirements related to cybersecurity and ensure that our cybersecurity program fully complies with all applicable laws and standards.

companyName: Rhinebeck Bancorp, Inc.

ticker: RBKB


text: The Company's cybersecurity risk management program is designed to employ industry best practices, including ongoing enhancement of governance, risk, and compliance management, regular updates to our response planning and protocols, security policy and standards maintenance, and new technology implementation to proactively monitor vulnerabilities and reduce risk, including processes designed to identify material cybersecurity risks associated with our use of third-party service providers. This program includes the engagement of consulting firms and other third parties.

companyName: HEALTHSTREAM INC

ticker: HSTM


text: We maintain a cyber insurance policy, we periodically meet with our insurance broker and insurer to discuss emerging trends in cybersecurity and we utilize self-assessment tools and other services provided by our insurance broker and insurer, including annual tabletop exercises conducted by cybersecurity experts.

companyName: Mid-America Apartments, L.P.


text: Our broader information security program aims to secure our systems, keep our business running, and protect our client partners, field talent, team members, and shareholders from vulnerabilities and threats by protecting against, detecting, and recovering from cybersecurity incidents. With oversight from our Board, the Audit Committee, and management, we have put proactive measures and systems in place in an effort to protect our information assets from unauthorized use or access. Our cybersecurity framework is based on the National Institute of Standards and Technology ("NIST").

companyName: BGSF, INC.

ticker: BGSF


text: We assess risks from cybersecurity threats by evaluating exposure of our assets to identified cyber risks, as well as potential impacts to our operations or reputation from our inability to access or utilize an asset or realize its value, or a threat actor's ability to gain access to an asset or its value. We further evaluate the potential materiality of these risks based on the potential impact to our operations or reputation.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, disaster recovery testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board of Directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: MARCUS CORP

ticker: MCS


text: The Corporation's information technology resources are managed by a separate Information Technology Department, which is responsible for identifying, assessing, and managing material risks from cybersecurity threats. The Information Technology Department is managed by the CIO, who reports to the Corporation's President and Chief Financial Officer. The present CIO has been employed by the Corporation in the information technology area for twenty-eight years and holds an undergraduate degree in computer science. The Information Technology Department also employs a separate Information Security Officer ("ISO"), whose responsibilities include security relating to the Corporation's information systems. The present ISO is a Certified Information Systems Security Professional and also a Certified Fraud Examiner. The ISO reports directly to the Information Technology Steering Committee and to the Chief Risk Officer. The ISO, among other duties, supervises internal employee training relating to cybersecurity risks, conducts access reviews relating to the Corporation's information systems, and monitors implemented checks and balances relating to access to information. Information relating to cybersecurity risks and cybersecurity incidents, if any, is reported by the CIO and the ISO to both the Risk Management Committee and to the Information Technology Steering Committee, each of which Committees includes the Chief Executive Officer and the President and Chief Financial Officer who are also directors of the Corporation.

companyName: PENNS WOODS BANCORP INC


text: As one of the elements of the Company's overall enterprise-wide risk management approach, the Enterprise Risk Management Program is focused on the following key areas: • Security Operation and Governance: As discussed in more detail under the section titled "Cybersecurity Governance," the Board Risk Oversight Committee has delegated to senior management responsibility for managing the Enterprise Risk Management Program. Senior management carries out this mandate through the Strategic Initiatives and Board Risk Oversight Committees. To maintain alignment and appropriate insight regarding information security activities, a bi-weekly operational committee provides general program insight. • Collaborative Approach: The Company has implemented a cross-functional approach to identifying, assessing, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management. • Security Competencies: The Company has security competencies and tools designed to evaluate security risks and to protect the confidentiality, integrity and availability of our information systems and data. These assets represent a blend of various management (e.g., policies), operational (e.g., standards and processes), and technical controls (e.g., tools and configurations). • Cyber Defense and Incident Response Plan: The Company utilizes sophisticated security monitoring and detection tools for continuous monitoring of our information systems 24 hours per day, seven days per week. The Company utilizes third-party tools and solutions to actively deliver threat analysis, vulnerability management, intrusion detection, intrusion hunting and red team exercises. We also receive the latest cybersecurity alerts and threat intelligence from government agencies and information sharing and analysis centers. The Company's Incident Response Plan helps reduce the risks related to security incidents by providing guidance on our response to incidents by focusing on the coordination of personnel, policies, and procedures to ensure incidents are detected, analyzed and managed. • Third-Party Risk Management: Management of the Company's third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven by risk factors established by the Third-Party Risk Management Program. The process provides awareness and collaboration across all internal teams including Information Technology and Risk Management. A review process is conducted on new or significantly changed key third parties, to ensure certain cybersecurity baseline requirements are met and cybersecurity incidents are appropriately disclosed. This process is aimed at advocating for appropriate standards and controls, based on risk factors, to secure the third parties' information systems, and to ensure the third parties have recovery plans in place. • Security Awareness and Education: The Company provides annual, mandatory training for personnel regarding security awareness to better equip Company personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Company's information security policies, standards, processes and practices. This training is supplemented with annual required third party information security training. Additionally, the Company conducts monthly email security awareness testing, with follow-up training assigned when deemed necessary.

companyName: SHORE BANCSHARES INC

ticker: SHBI


text: Our entire Board of Directors provides oversight of the Company's cybersecurity policies, processes and capabilities as part of their overall oversight of risk management. Once a year, our Vice President, Cyber Security reports to the Audit Committee providing a detailed update on the threat landscape, emerging trends and the Company's mitigation efforts. This report also includes Tronox's performance as measured by the NIST Cybersecurity Framework Scorecard. As needed on a periodic basis, our Vice President, Cyber Security updates the Audit Committee on specific cybersecurity events and newly emerging risks and the actions taken by the Company in response to those events and risks. The Audit Committee updates the full board on these matters as necessary. The full Board reviews and assesses cybersecurity risks in connection with its annual Enterprise Risk Management review.

companyName: Tronox Holdings plc

ticker: TROX


text: At present, we have not implemented system monitoring, employee training, or incident response protocols. We have not experienced any cybersecurity incidents to date, but any cyber security incident may negatively impact our operations.

companyName: Adapti, Inc.

ticker: ADTI


text: Our full Board considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program. The Board receives quarterly reports from management on cybersecurity risks. In addition, management is responsible for updating the Board, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant.

companyName: Rent the Runway, Inc.

ticker: RENT


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past, and we could in the future experience similar attacks. As of Fiscal 2023, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operations or financial condition. For more information about the Company's assessment of cybersecurity risks, see the risk factor titled "A privacy breach, through a cybersecurity incident or otherwise, or failure to comply with privacy laws could have a material adverse effect on our business" in Part I, Item 1A, "Risk Factors".

companyName: Childrens Place, Inc.

ticker: PLCE


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure. The board's Audit Committee oversees the management of cybersecurity risks relating to financial, accounting, and internal control matters. The full board receives regular updates from our senior management and outside advisors regarding cybersecurity risks Autodesk faces. Our Enterprise Risk Management function is responsible for identifying, prioritizing, and mitigating risks that could limit Autodesk's achievement of its strategic and operational priorities. Our executive officers are responsible for the day-to-day assessment and management of these risks.

companyName: Autodesk, Inc.

ticker: ADSK


text: In an effort to deter and detect cyber threats, we also periodically provide all employees with a data protection and cybersecurity awareness training program, which covers timely and relevant topics, including phishing, password protection, confidential data protection, asset use, and mobile security and further educates employees on the importance of and process for reporting all potential incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster employee-based cybersecurity programs.