text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program, which is managed by Cognizant's Corporate Security team, is designed to identify, assess and manage risks from cybersecurity threats and provides a framework for handling cybersecurity threats and incidents. The program is also aligned with the risk assessment framework established by the enterprise risk management team.

companyName: COGNIZANT TECHNOLOGY SOLUTIONS CORP

ticker: CTSH


text: Risks from Cybersecurity Threats As of the date of this Annual Report, though we and the third parties with whom we do business have experienced certain cybersecurity incidents, we are not aware of cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business, financial condition or results of operations. However, we recognize that cybersecurity threats are continually evolving, and there remains a risk that a cybersecurity incident could potentially negatively impact us. Despite the implementation of our cybersecurity processes, we cannot guarantee that a significant cybersecurity attack will not occur. A successful attack on our information or operational technology systems could have significant consequences to the business, including the interruption of key services that our customers depend on. While we devote resources to our security measures to protect our operations and information, these measures cannot provide absolute security.

companyName: Atlas Energy Solutions Inc.

ticker: AESI

secItem: Item 1C


text: Currently, our sole director does not have a formal structure for overseeing cybersecurity risks. We plan to review this oversight in the near future to ensure appropriate governance is established.

companyName: T3 Defense Inc.

ticker: DFNS


text: We have a cybersecurity risk management program that is managed by a team of full-time cybersecurity professionals that utilizes a variety of tools and techniques to identify and assess material cybersecurity threats, their potential impact and opportunities for mitigation. The industry-standard security frameworks that we apply to our cyber environment include various security and risk assessments, such as internal threat assessments and internal control self-assessments. Because we are aware of the risks associated with third-party providers, we conduct third-party provider security assessments and benchmarking before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. These assessments include evaluation of risk profiles through vendor questionnaires, review of System and Organization Controls attestation reports and monitoring on an ongoing basis by our IT risk management team. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties.

companyName: BLACK HILLS CORP /SD/

ticker: BKH


text: As part of the above processes, we at least annually engage with assessors, consultants, and other third parties to measure and assess our maturity level against standard frameworks. Also, an independent Qualified Security Assessor review regarding Payment Card Industry compliance is performed on a quarterly basis to help ensure we maintain compliance with the PCI standards. These third parties conduct penetration tests and scanning exercises to assess the performance of our cybersecurity controls, systems and processes and overall maturity by NIST categorization. As part of the assessment, they also conduct interviews with key personnel and review key controls. In addition, annually we review our cyber insurance premiums which includes a maturity assessment and the premiums are determined based on the Company's cybersecurity maturity assessment score.

companyName: Warner Music Group Corp.

ticker: WMG


text: Our Vice President, Finance is responsible for assessing and managing risks from cybersecurity threats. Innventure's Vice President, Finance has a Bachelor's degree in Accounting and a Master of Business Administration degree. Our Vice President, Finance is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through reports from an external consultant. The external consultant has 20 years of cybersecurity experience. The external consultant also has an Associate's degree in Database Administration and Network and System Administration. The external consultant also maintains the industry-recognized CompTIA Security+ certification. The Vice President, Finance reports any exposure to risks from cybersecurity threats to our CFO. The Company intends for the CFO to regularly provide updates on risks related to cybersecurity to the Audit Committee.

companyName: Innventure, Inc.

ticker: INV


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems, or those of the third parties with whom we work, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss or revenue or profits; and other adverse consequences that could have a material adverse effect on our business, financial condition, results of operations and cash flows." Our board of directors (the "Board")

companyName: Avid Bioservices, Inc.


text: Our management team is informed about and monitors the efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: HESS CORP


text: Our CISO leads our global cybersecurity team and is responsible for our cybersecurity program. Our current CISO has served in various roles in information technology and information security for over twenty years, including at our Company since 2013. He holds an MBA and a Certified Information Systems Security Professional certification. Our CISO reports to our Chief Technology Officer, who reports to our Chief Executive Officer.

companyName: Under Armour, Inc.

ticker: UAA


text: Our management team, including our Senior Vice President of Information Systems and Vice President of Information Security and Compliance, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team overseeing cybersecurity has over 25+ years of technology and cybersecurity experience, and certain of our team hold various cybersecurity certifications, including the Certified Information Systems Security Professional (CISSP) certification.

companyName: Extra Space Storage Inc.

ticker: EXR


text: The Company's Board of Directors (the Board) through its audit committee (Audit Committee) is responsible for overseeing the Company's risk management program. The Company integrates cybersecurity risk management into its broader risk management framework to ensure that cybersecurity considerations form an integral part of our risk management program. Our Information Technology (IT) department works closely with the risk management team to evaluate and address cybersecurity risks. The Company's cybersecurity strategy and risk management processes align with the National Institute of Standards and Technology (NIST) governance requirements and cybersecurity framework.

companyName: V2X, Inc.

ticker: VVX


text: Mattel has processes in place for assessing, identifying, and managing material risks from cybersecurity threats, which include developing, implementing, and maintaining cybersecurity measures and controls. Mattel considers the following factors, among others, to assess whether adequate protections are in place to address risks from known and anticipated cybersecurity threats: likelihood and severity of risk; impact on Mattel and others, including retail customers, suppliers, consumers, or employees, if a risk materializes; feasibility and cost of controls; and impact of controls on operations.

companyName: MATTEL INC /DE/

ticker: MAT


text: As of the date of this report, we are not aware of any cybersecurity incidents that have had a material effect on our operations, business, results of operations, or financial condition.

companyName: Good Times Restaurants Inc.

ticker: GTIM


text: Engagement of Third Parties As part of our Cyber Risk Program, we engage outside independent auditors, consultants, and professional advisors. We also engage industry-leading cybersecurity service and systems providers to assist with protection from and detection of cybersecurity threats and incidents and our responses to them.

companyName: E2open Parent Holdings, Inc.


text: While our Board and Audit Committee oversee risk, our senior leadership is responsible for identifying, assessing and managing our exposure to risk, including material risks from cybersecurity threats. Direct accountability of our cybersecurity program is housed within our Information Technology organization, which is led by our Chief Information Officer ("CIO"). Our CIO has served in this role since October 2021. Our CIO has 12 years of experience in senior technology roles with cybersecurity responsibilities. Prior to joining the Company, our CIO held various executive technology and operations positions, as well as various IT, consulting and commercial roles. Our CIO holds an Executive MBA and a Bachelor of Commerce degree.

companyName: HERTZ GLOBAL HOLDINGS, INC

ticker: HTZ


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with its use of such entities. The Company's Chief Compliance Officer (" CCO ") also plays an oversight role in the area of cybersecurity preparedness with respect to these entities.

companyName: Andalusian Credit Company, LLC


text: We rely on information technology ("IT") systems, including data hosting facilities and other hardware and software platforms, some of which are hosted by third parties, to assist in conducting our businesses. Our IT systems, like those of most companies, may be vulnerable to certain cybersecurity threats such as ransomware, interruption of services, data breaches, or any other cyber incident that could adversely impact our ability to operate its core business functions. As a financial services firm, we do not maintain a significant level of personally identifiable information data. Accordingly, our exposure to data breaches is more limited. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, cash flow or financial condition. However, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks.

companyName: STARWOOD PROPERTY TRUST, INC.

ticker: STWD


text: Management's Role Managing Risk The CISO, the Vice President, Information Technology ("VP of IT"), the Chief Executive Officer ("CEO") and the Chief Financial Officer ("CFO") play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide cybersecurity briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including as applicable: the current cybersecurity landscape and emerging threats, the status of ongoing cybersecurity initiatives and strategies, incident reports and learnings from any cybersecurity events, and compliance with regulatory requirements and industry practices. In addition to our scheduled meetings, the Audit Committee, CISO, VP of IT, CEO and CFO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates from one another, as appropriate, on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Cytokinetics. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: CYTOKINETICS INC

ticker: CYTK


text: We recognize the critical importance of cybersecurity and data privacy in safeguarding our operations, sensitive data, and maintaining the trust of our stakeholders. Cybersecurity incidents and threats as potential risks that may impact our operations and information systems. We have developed and implemented cybersecurity and data privacy programs in accordance with the requirements of ISO standards 27001:2013 and 27701:2019, which are intended to appropriately preserve the confidentiality, integrity, and availability of information maintained by our company. These programs identify, select, maintain, operate, and improve cybersecurity and privacy controls.

companyName: EXPONENT INC

ticker: EXPO


text: The Audit Committee of the Board of Directors is charged with a majority of the risk oversight responsibilities on behalf of the Board of Directors, including risks associated with IT and cybersecurity. The Board of Directors and the Audit Committee are updated periodically on cybersecurity matters. Our Chief Financial Officer ("CFO") and General Counsel both report directly to our Chief Executive Officer ("CEO") and periodically meet with the Audit Committee in conjunction with a review of our quarterly and annual periodic SEC filings to discuss important risks we face, highlighting any new risks that have arisen since the prior meeting. Specifically with respect to cybersecurity, our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") join our CFO and General Counsel to provide updates directly to the Audit Committee, along with third party experts engaged to recommend enhancements to and improve the Company's cybersecurity practices. In addition, all non-management members of the Board of Directors are invited to attend all committee meetings, regardless of whether the individual sits on the specific committee. Board of Directors members have access to senior executives, including our CFO and General Counsel, and in addition to periodic reports, we maintain formal processes for escalating live issues to the Audit Committee and the Board of Directors, as described below.

companyName: Evercore Inc.

ticker: EVR


text: The CISO, who reports to the Senior Director of Technology, is the management position with primary responsibility for the development, operation, and maintenance of our information security program. The CISO has been with the Company for 40 years, is a certified CISSP, CRISC, and CIPM and oversees a team of experienced individuals. In addition to the working committee meetings described above, the CISO and Senior Director of Technology meet regularly with the Company's President and with other members of senior management to review the current state of the cybersecurity program and emerging threats to the Company.

companyName: DILLARD'S, INC.

ticker: DDS


text: In our business operation, we utilize various third-party service providers, including credit card companies, banks and financial platform providers, to process financial transactions and implement various software and information system processes. To that effect, we seek to engage reliable, reputable service providers that maintain cybersecurity programs.

companyName: Stabilis Solutions, Inc.

ticker: SLNG


text: The Trust does not have any officers, directors or employees. The Sponsor, a subsidiary of WisdomTree, Inc., is responsible for the oversight and overall management of the Trust. The Sponsor relies on WisdomTree Inc.'s cybersecurity framework for the Trust's cybersecurity risk management and strategy. Key aspects of such framework are summarized below.

companyName: WisdomTree Bitcoin Fund

ticker: BTCW


text: The Audit Committee of our Board of Directors provides oversight for our cybersecurity program and our enterprise risk management process, which evaluates enterprise level risks and strategies, including our cybersecurity risk. The Audit Committee receives updates from management on the effectiveness of our cybersecurity program. The Audit Committee also reviews plans on how management will enhance the program, receives updates on special topics that help the Committee provide effective oversight of the program, and is notified in the event of certain cybersecurity incidents.

companyName: Stitch Fix, Inc.

ticker: SFIX


text: Overall, the Company has implemented tactical processes for assessing, identifying, and managing material risks from cybersecurity threats to the company including governance at the Board level and accountability in our executive management for the execution of the Company's cyber risk management strategy and the controls designed to protect its operations. In addition, we maintain cyber insurance that is designed to protect us against certain losses related to cyber risks, and we believe the amount and scope of this insurance are customary for similarly situated companies in the telecommunications industry. See ITEM 1A. RISK FACTORS for additional information regarding the Company's cybersecurity risks. Those sections of Item 1A should be read in conjunction with this Item 1C.

companyName: Uniti Group LLC


text: The Corporation has developed and implemented an Information Security Program based on the Cybersecurity Framework (CSF) best practices and recommendations from the National Institute of Standards and Technology (NIST), applicable regulatory guidance, and other industry standards. Components of the program include a risk assessment program to identify, assess, and mitigate cybersecurity risk; a vendor management program to address third-party cybersecurity risk; a business continuity program (BCP) to ensure continuity of operations; and an incident response program documenting cybersecurity incident response and notification procedures. The Corporation's Information Security Officer (ISO) oversees the programs and reports on their statuses to management committees including the Senior Leadership Committee, ERM Governance Committee, and Operational Risk Committees.

companyName: ENB Financial Corp

ticker: ENBP


text: Cybersecurity is a critical component of the Company's enterprise risk management program given the Company's extensive reliance on technology and increased and evolving risks from cyber threats. Our Chief Information Security Officer ("CISO") is primarily responsible for the Company's information systems and cyber security program, which is designed to protect the confidentiality, integrity, and availability of our technology systems and data. The information systems and cyber security program is vital to protecting our customers, maintaining our reputation, and preserving shareholder value, as well as safeguarding the interests of other stakeholders. The CISO is a key member of the Company's risk management organization and reports directly to the Chief Risk Officer ("CRO") and, periodically, to the Risk Committee of the Board of Directors.

companyName: LAKELAND BANCORP INC


text: We rely on a multidisciplinary team (including information security stakeholders and management, as described further below in "Cybersecurity—Governance") to help assess how cybersecurity threats to our Information Assets could impact our business. We seek to assess the likelihood that such threats could result in a material impact to our Information Assets, operations, ability to provide our services, our core business functions, personnel, reputation, and identified critical business objectives. We identify, assess, and manage our cybersecurity threats and risks by, among other things, ongoing threat modeling discussions of certain of our applications and infrastructure, reviewing certain weekly security bulletins, monitoring the threat environment using manual and automated tools in certain environments and systems, subscribing to reports and services that identify certain cybersecurity threats, analyzing reports of certain threats and actors, scans of certain threat environment, evaluating our industry's risk profile, evaluating threats reported to us from our public-facing bug bounty program, conducting threat assessments for certain internal and external threats, and conducting vulnerability assessments in some environments and systems aimed at identifying vulnerabilities.

companyName: Grindr Inc.

ticker: GRND


text: We ensure compliance with PRC laws and regulations, including but not limited to the Cybersecurity Law, the Personal Information Protection Law and The Cybersecurity Review Measures (2021 version). We endeavor to take appropriate measures to protect national secrets and sensitive data while ensuring that the disclosure complies with PRC restrictions on data transport.

companyName: TANCHENG GROUP CO., LTD.

ticker: QSJC


text: Cybersecurity risk for all Registrants is managed at the enterprise-level. Management of material risks from cybersecurity threats is integrated into the Registrants' overall risk management processes and is monitored as an enterprise risk. Exelon's Chief Information Security Officer (CISO) and cybersecurity management team regularly hold meetings with senior management of each Registrant, facilitated by Exelon's enterprise risk management team, to discuss issues pertaining to cybersecurity risk management, including changes in the nature and origin of threats, threat actor and risk mitigation activities, and regulatory developments. Exelon Legal and compliance professionals engage with the CISO and cybersecurity management team to address tactical and strategic cybersecurity risks. Exelon monitors cybersecurity risks through key risk indicators to identify potential changes in risk exposure and provide the Board of Directors with information about the monitoring of key risks in connection with its oversight of the Registrants' enterprise risk management system.

companyName: EXELON CORP

ticker: EXC


text: Our cybersecurity team analyzes all third-party vendors for compliance with our internal Info-Sec Policy in order to help us assess potential risks associated with their security controls. We also generally require third parties to, among other things, maintain security controls to protect our confidential information or data, and to notify us promptly, but in any case, no later than twenty-four (24) hours after the occurrence of any data breach or cybersecurity incident that may impact our data. After coordinating a response to any third-party cybersecurity incident, the incident response team reviews service providers' compliance with the privacy and data security requirements of our Info-Sec Policy, obtains written assurance of corrective actions, as appropriate, and considers whether additional measures need to be taken to protect the Company.

companyName: Riot Platforms, Inc.

ticker: RIOT


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our information technology ("IT") contractor. Our IT consultant leverages their over 35 years of experience. Our IT consultant is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity incidents.

companyName: Grace Therapeutics, Inc.

ticker: GRCE


text: Our team of cybersecurity focused employees, under the direction of our CIO, is responsible for assessing our cybersecurity risk and detecting, mitigating and remediating cybersecurity incidents. Our CIO and dedicated personnel are certified and experienced information systems security professionals and information security managers. Personnel with significant security responsibilities receive specialized education and training on their roles and responsibilities prior to being granted access to systems and resources. The pre-employment process for these roles is designed to ensure that security responsibilities are specifically defined. Our CIO has over 25 years of technology leadership experience.

companyName: American Well Corp

ticker: AMWL


text: Additionally, as part of our overall risk mitigation strategy, the Company obtains certain insurance policies. However, such insurance may not be sufficient in type or amount to cover us fully against claims related to security breaches, cyber-attacks and other related breaches.

companyName: Rezolute, Inc.

ticker: RZLT


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For more information, see the section titled "Risk Factor—Risks related to our intellectual property, information technology and data security—If we or our critical third-party providers experience a significant disruption in our information technology systems or breaches of data security, our business could be adversely affected."

companyName: 10x Genomics, Inc.

ticker: TXG


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to associates or customers; violation of privacy or security laws; other litigation and legal risk; and reputational risks. These cybersecurity risks and other company risks are monitored and integrated into our enterprise risk management process. As part of this process, appropriate personnel consult with subject matter specialists as necessary to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: WILLIAMS SONOMA INC

ticker: WSM


text: Each year, our team of cybersecurity specialists builds a strategic vision of shared outcomes which provides the basis for how cybersecurity risks are factored into the Company's risk management initiatives. Along with the rest of the Company, the cybersecurity team, led by the CISO, sets goals for cybersecurity risk management that are then periodically tracked and reported back to the cybersecurity team and to our CEO and Audit Committee.

companyName: TRIMBLE INC.

ticker: TRMB


text: Ellington's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below under "Governance," our Board of Directors' oversight of cybersecurity risk management is supported by the Audit Committee of our Board of Directors (the "Audit Committee"), which regularly interacts with our management team and other professionals who are responsible for assessing and managing material risks from cybersecurity threats at Ellington. • Collaborative Approach: Ellington has implemented a cross-functional approach to identifying and evaluating, preventing, mitigating and remediating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents. Such escalation allows Ellington to make timely decisions regarding its response to such incidents and whether disclosure to senior management, our Audit Committee and/or the public is appropriate. • Technical Safeguards: Ellington deploys technical safeguards that are designed to protect information systems from cybersecurity threats. These systems cover many facets of cyber security including identity protection, anti-virus and anti-malware defense, data loss prevention, endpoint protection (including managed detection and response services), patch and vulnerability management and others. Ellington regularly evaluates new technologies as the cyber security landscape evolves. • Incident Response and Recovery Planning: Ellington has established and maintains incident response and recovery plans that we believe properly address the response to a cybersecurity incident or other business disruption. To the extent feasible, such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: Ellington follows a risk-based approach to identifying and overseeing cybersecurity risks presented by third-parties, including vendors, service providers and other external users of Ellington's systems, as well as the systems of third-parties that could adversely impact Ellington's business in the event of a cybersecurity incident affecting their systems. Third-party service providers are regularly evaluated by Ellington to assess their cyber security posture and general information technology practices to determine if they are suitable partners; where applicable, relevant certifications are obtained such as SOC 2 or ISO 27001. • Education and Awareness: Ellington: (i) provides regular, mandatory cyber security training to all personnel to equip them with tools to identify and address cybersecurity threats; (ii) communicates evolving information security policies, standards, processes and practices to employees via email; (iii) delivers additional training to all users who have access to personally identifiable information on Ellington's processes for handling such information; and (iv) conducts regular, monthly phishing tests to assess user alertness, and retains a separate external cybersecurity vendor to conduct similar tests on an annual basis.

companyName: Ellington Financial Inc.

ticker: EFC


text: The Company has implemented a Cybersecurity Incident Response Plan (the "Plan"), which is integrated into its overall crisis management program. The Plan provides a framework for responding to cybersecurity incidents. The Plan identifies applicable requirements for incident disclosure and reporting as well as provides protocols for incident evaluation, including the use of third-party service providers and partners, processes for notification and internal escalation of information to the Company's senior management, the disclosure committee, the Board and appropriate Board committees. The Plan also addresses requirements for the Company's external reporting obligations. The Plan is reviewed and updated, as necessary, under the leadership of the Company's Chief Information Security Officer ("CISO") and Chief Privacy Officer ("CPO").

companyName: CVS HEALTH Corp

ticker: CVS


text: We maintain a risk-based approach to identifying and managing cybersecurity threats presented to Walmart by third-party systems that support our operations, as well as third-party users of our data and systems, including vendors, service providers and subcontractors.

companyName: Walmart Inc.

ticker: WMT


text: As part of our cybersecurity risk management process, we conduct regular application security assessments, vulnerability management, external penetration testing, security audits, and risk assessments. We leverage third-party security service providers to provide continuous and uninterrupted identification and mitigation of risk-prioritized security events. We maintain an incident response plan that is utilized when incidents are detected. Our incident response plan coordinates the activities that we and our third-party cybersecurity provider take to prepare to respond, recover from and mitigate cybersecurity incidents, which include processes to assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational harm.

companyName: Digital Turbine, Inc.

ticker: APPS


text: Management reports to the Audit Committee on a quarterly basis regarding our information security programs. As part of its oversight responsibilities, the Audit Committee regularly discusses and reviews with management, among other items, Aptar's compliance and cybersecurity programs. We also periodically test our systems for vulnerabilities and regularly engage third parties to conduct evaluations of our security controls whether through penetration testing, independent audit or consulting on best practices to address new challenges. An independent review of our cybersecurity program has been assessed against the National Institute of Standards and Technology (NIST) cybersecurity framework. In addition, we maintain cybersecurity insurance as part of our overall insurance portfolio.

companyName: APTARGROUP, INC.

ticker: ATR


text: Our Chief Information Officer, who has over 20 years of experience in the cybersecurity and information security space, leads our global information security team responsible for overseeing the Emerald information security program. We also have a Director of Cyber Security who brings 24 years of experience in the information technology field, including 15 years of direct experience in cybersecurity. In addition, the team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies. This team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments, and findings.

companyName: Emerald Holding, Inc.

ticker: EEX


text: Risks from Cybersecurity Threats To date, we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. However, we are subject to risks from cybersecurity threats that could have that effect, as further described in Item 1A "Risk Factors" of this Annual Report.

companyName: ZimVie Inc.


text: Important to these programs is our Manager's investment in threat-intelligence, its active engagement in industry and government security-related forums, and its utilization of external experts to challenge its program maturity, assess its controls and routinely test its capabilities.

companyName: Invesco Mortgage Capital Inc.

ticker: IVR


text: The Trust's cybersecurity risk management is established and governed by the Sponsor. The Sponsor determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for the Trust and the Trust relies on the Sponsor for assessing, identifying and managing material risks to the Trust's business from cybersecurity threats. The Sponsor's cybersecurity policies and practices are set out in the Sponsor's compliance manual and are reviewed on an annual basis. In addition, all officers of the Sponsor and all employees of Bitwise receive annual compliance training and annual cybersecurity training. Attendance at the annual cybersecurity training and the annual compliance training is tracked and recorded.

companyName: Bitwise 10 Crypto Index ETF

ticker: BITW


text: The Company's Chief Digital and eCommerce Officer (CDEO) oversees the Company's incident response plan and related processes designed to assess and manage material risks from cybersecurity threats. The CDEO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes. The experience of our Response Team includes cybersecurity incident response, in-depth security assessments and security evaluation exercises to evaluate security profile, security research, education and outreach, and security tool development.

companyName: Charlotte's Web Holdings, Inc.

ticker: CWBHF


text: Through our IT consulting firm, we employ continuous monitoring mechanisms to detect and respond to cybersecurity threats promptly. Reports are generated as needed for management and the Board of Directors, providing insights into our cybersecurity posture, incidents, and remediation efforts. We conduct regular assessments and testing of our controls, especially those related to the protection of financial information. The implementation and management of these processes are integrated with the Company's overall operational risk management processes that seeks to limit our exposure to unnecessary risks across our operations and is overseen by the Audit Committee of the Board of Directors.

companyName: Stardust Power Inc.

ticker: SDST


text: At the management level, our CEO provides general management, oversight and mitigation of Cars Commerce's risk. Our Chief Technology Officer and Senior Vice President of Information Security manage Cars Commerce's Information Security function. The Information Security Team is composed of skilled professionals with relevant information and cybersecurity education, certifications and experience. The Information Security Team coordinates with the Cars Commerce Information Security Governance Committee, comprised of senior business leaders who support Cars Commerce's Information Security Management System based on their area of expertise. Cars Commerce's Information Security Team, in conjunction with the Information Security Governance Committee, assesses and manages material risks from cybersecurity threats and provides management direction and support for information security. Working together the teams initiate and control the implementation and operation of information security within Cars Commerce.

companyName: Cars.com Inc.

ticker: CARS


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms, including legal counsel, threat intelligence service providers, cybersecurity consultants and software providers, managed cybersecurity service providers, penetration testing firms and dark web monitoring services.

companyName: Keros Therapeutics, Inc.

ticker: KROS


text: The Company enforces a top-down approach to cybersecurity governance, ensuring accountability and continuous risk monitoring at all levels of the organization.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: RED Technologies has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of RED Technologies' critical systems and information. RED Technologies' cybersecurity risk management program includes a cybersecurity incident response plan. RED Technologies designs and assesses its program based on ISO 27002 standards. This does not imply that RED Technologies meets any particular technical standards, specifications, or requirements, only that it uses the ISO 27002 as a guide to help it identify, assess, and manage cybersecurity risks relevant to its business. RED Technologies uses established processes designed to identify, assess, and manage third-party service provider risks when third parties handle, possess, process, and store RED Technologies' material information. RED Technologies' cybersecurity risk management program includes (i) a policy designed to help identify material cybersecurity risks to its critical systems, information, products, services, and its broader enterprise information technology environment and (ii) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents. RED Technologies has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect RED Technologies, including its operations, business strategy, results of operations, or financial condition. However, there can be no assurance that RED Technologies' cybersecurity prevention and mitigation efforts will always be successful, and it is possible that cybersecurity threats could have a material adverse effect on our business, operations, or financial condition in the future.

companyName: CONX Corp.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We conduct regular risk assessments to identify cybersecurity threats and assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats.

companyName: ATECH (PARENT) RESOLUTION CORP.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Director of IT Security, Data Management, Analytics and Integration, and General Counsel. Director of IT Security, Data Management, Analytics and Integration, and General Counsel work with the Company's cross functional incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policies and procedures include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Allogene Therapeutics, Inc.

ticker: ALLO


text: The Company's officers report significant cybersecurity risks and incidents directly to the Cybersecurity Committee and Audit Committee on a quarterly basis or more frequently if warranted under the circumstances.

companyName: Woodbridge Liquidation Trust

ticker: WBQNL


text: Our cybersecurity policies, standards, processes and practices are informed by industry-recognized standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is designed to preserve the confidentiality, security and availability of the information that we collect and store.

companyName: HUBSPOT INC

ticker: HUBS


text: Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the audit committee of the board of directors. The audit committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The audit committee also reports material cybersecurity risks to our full board of directors. Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Technology Officer, or CTO, who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CTO and dedicated personnel are certified and experienced information systems security professionals and information security managers with over 15 years of experience and are certified information systems security professionals. Management, including the CTO and our cybersecurity team, regularly update the audit committee on the company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports quarterly that cover, among other topics, third-party assessments of the company's cybersecurity programs, developments in cybersecurity, learning and training activities and updates to the company's cybersecurity programs and mitigation strategies.

companyName: Katapult Holdings, Inc.

ticker: KPLT


text: The Company is exposed to cybersecurity threats and incidents that can range from uncoordinated individual attempts to gain unauthorized access to information systems to sophisticated and targeted measures known as advanced persistent threats, directed at the Company or its third party service providers. Our customers, strategic relationships and regulators expect us to maintain a suitable cybersecurity posture to identify, protect, detect, respond and recover from incidents that may impact the confidentiality, integrity and availability of sensitive information we possess. We evaluate the risks of data theft (including theft of sensitive, proprietary and other data categories, in addition to personal data), harm to customer or third party relationships and litigation or regulatory investigation or actions that could materially adversely affect our financial condition, results of operations and reputation. Cybersecurity risk is assessed and managed primarily through our operations, risk management, and audit teams and is overseen by our Board of Directors.

companyName: Finwise Bancorp

ticker: FINW


text: Following these risk assessments, we consider whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. In consideration of the size and complexity of our business, we devote significant internal and external resources to manage material risks from cybersecurity threats. We also designate specific personnel, including our Senior Director, Information Technology, to manage the risk assessment and mitigation process and to closely coordinate with our General Counsel on applicable regulatory obligations.

companyName: Tenaya Therapeutics, Inc.

ticker: TNYA


text: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are evaluated by management, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: ZYNEX INC

ticker: ZYXIQ


text: Members of the Information Technology Steering Committee, and other members of the Board, are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management process. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.

companyName: FIRST US BANCSHARES, INC.

ticker: FUSB


text: We have adopted an incident response plan that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to such cybersecurity threats or incidents. The plan sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping our Management Committee, the Audit Committee, the Board, and other key stakeholders informed and involved as appropriate. The plan is aligned to NIST guidance. It also includes the involvement of any personnel who may detect incidents, respond to incidents, resolve incidents, and manage communications and responsibilities with authorities about those incidents. The plan applies to all personnel (including third-party contractors, vendors, and partners) that perform functions or services requiring access to secure Company information, and to all devices and network services that are owned or managed by us.

companyName: MCCORMICK & CO INC

ticker: MKC


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including reporting certain incidents to a cross-functional group responsible for making ongoing assessments of reported incidents, led by our Chief Legal Officer and Chief Technology Officer, and includes members of our standing Disclosure Committee. The Chief Legal Officer is responsible for informing the Audit and Risk Committee regarding the Company's significant cybersecurity threats and risk and meets with the Audit and Risk Committee at periodic or special meetings to review and discuss issues. Our Chief Legal Officer oversees an annual enterprise risk assessment that addresses certain applicable cybersecurity risks, the results of which are presented to the Audit and Risk Committee. We engage a third party consulting firm to assist with the annual enterprise risk assessment. Our Chief Legal Officer works with the Board, senior management, others at various levels of the organization, and our outside advisors to help identify, assess, and validate the Company's top risks, taking into account past risk mitigation activities and future plans. Under our Cybersecurity Incident Reporting Policy, the Chief Legal Officer is also responsible for communicating to the Audit and Risk Committee the activities of the Company related to the assessments and reporting of potentially significant cybersecurity incidents.

companyName: Dutch Bros Inc.

ticker: BROS


text: The Company has also formed management committees including the Management Risk Committee, which focuses on multiple aspects of risk management including information technology, and the Technology Steering Committee, which focuses on technology and cybersecurity policy within the Bank. These management committees provide oversight and governance of our technology and information security programs. The management committees are chaired by managers within the information technology and information security departments and include the Chief Risk Officer, Chief Information Security Officer, and Chief Digital & Innovation Officer as well as their direct reports and other key departmental managers from throughout the entire company. The management committees meet at least quarterly to provide oversight of key risk management strategies, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks, especially those related to cybersecurity and technology risks. More frequent meetings occur from time to time in accordance with the CIRP in order to facilitate timely informing, monitoring, and response efforts. The Chief Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Technology Steering Committee of the board on a monthly basis (or more frequently as may be required by the CIRP).

companyName: PROVIDENT FINANCIAL SERVICES INC

ticker: PFS


text: We face a number of cybersecurity risks in connection with our business. Although risks from cybersecurity threats have to date not materially affected us, and we do not believe they are reasonably likely to materially affect us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats and security incidents relating to our and our third party vendors' information systems. For more information, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.

companyName: Entrada Therapeutics, Inc.

ticker: TRDA


text: The Board of Directors' involvement in cybersecurity governance underscores our commitment to safeguarding our operations and stakeholders from digital risks. With dedicated oversight from both executive leadership and the Board of Directors, we integrate cybersecurity into our risk management and governance frameworks.

companyName: Inotiv, Inc.

ticker: NOTV


text: Identifying, assessing and managing cybersecurity threats We and Deutsche Bank Group operate in an environment with increasing levels of digitization and a constantly evolving landscape related to cybersecurity threats. Due to the dynamics and complexity of the current environment, the Deutsche Bank Group is continuously monitoring the security threat landscape. Deutsche Bank Group vigilantly observes technological developments, the geopolitical landscape and economic impacts driving security risks and assesses their relevance for potential impacts to Deutsche Bank Group and the wider financial ecosystem.

companyName: RREEF Property Trust, Inc.


text: Under the oversight of the Audit Committee, our management and the INFOSEC team have established comprehensive processes for identifying, assessing and managing material risks from cybersecurity threats, and these processes are integrated into our overall enterprise risk management program. Our approach is proactive and adaptive, featuring regular security assessments, third-party audits, team member training, and continuous improvement of our cybersecurity infrastructure. We work to align our practices with industry best practices and regulatory standards. We continually evaluate our information technology systems to identify new and monitor existing cybersecurity risks based on observed activity on the systems. We evaluate the nature and severity of identified risks, and whether changes to the system are necessary. We perform annual cybersecurity training for all employees with access to our systems and conduct regular test phishing campaigns. We engage a third-party to assist in monitoring, preventing and detecting potential cybersecurity vulnerabilities and incidents, including performing scans of our information technology systems and penetration testing. We use the results of the various tests to inform our response plan, update our systems, and train employees.

companyName: Boot Barn Holdings, Inc.

ticker: BOOT


text: Littelfuse strives to assess and update its cybersecurity program on a regular basis using an Information Security Management System ("ISMS") comprised of three main elements – 1) independent internationally recognized vendors and technologies for assessments and monitoring, 2) strong internal controls based on industry standards, and 3) Board and Senior Leadership governance and support.

companyName: LITTELFUSE INC /DE

ticker: LFUS


text: The Bank's approach to cybersecurity risk management relies upon having the right people, processes, and technology in place to identify, protect, detect, respond, and recover from cybersecurity threats/incidents. The Bank's cybersecurity program aligns with industry standards, specifically the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the NIST 800-53 control framework. The effectiveness of the Bank's cybersecurity program is measured through internal and external audits, Finance Agency regulatory oversight and other third-party control and compromise assessments such as periodic penetration tests and various security assessments. In addition, the Bank's cybersecurity program includes processes and technologies that enhance its ability to detect and respond to cybersecurity threats, including the use of automation, threat intelligence feeds, robust incident response procedures and frequent vulnerability scans and remediation. The Bank's Vulnerability Management Group, which is comprised of members from Information Technology ("IT") Security, IT Infrastructure and Operational Risk Management, meets regularly to discuss details of the Bank's vulnerability management program including, but not limited to, current threats and vulnerabilities, patching status, upcoming technology changes, and current issues or concerns, if any.

companyName: Federal Home Loan Bank of Dallas


text: In order to provide proper management of cybersecurity risk, management has committed to the following plan: (1) foster an environment that values cybersecurity initiatives in order to accomplish business and operational goals; (2) review and update the cybersecurity program on an annual basis; (3) perform a cybersecurity risk assessment on an annual basis requiring that the performance of the assessment meets standards set forth by the Federal Financial Institutions Examination Council ("FFIEC") guidelines and external auditors; (4) foster awareness and training for all employees; (5) enlist additional support of third-party experts in the event of cybersecurity incidents; (6) subscribe to cybersecurity forums where information is distributed; (7) monitor and respond to cybersecurity threats and alerts; (7) review and update the business continuity plan, IRP, and vendor management plan, focusing on cyber-resiliency and third-party management of cyber activities; and (8) keep the Audit Committee, IT Committee and Board informed on the status of cybersecurity.

companyName: Prime Meridian Holding Co

ticker: PMHG


text: Cybersecurity risks and the adequacy of associated mitigations are analyzed by senior leadership as part of the enterprise risk assessments that are reported to and discussed by our Board of Directors. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. While we have not experienced any material cybersecurity incidents, there can be no guarantee that we will not be the subject of future incidents. For additional information on cybersecurity risks we face, see "Item 1A. Risk Factors", of this Annual Report, which should be read in conjunction with the foregoing information.

companyName: FLOWSERVE CORP

ticker: FLS


text: Our information security function is overseen by our Privacy and Security Officer and is supported by our Director of Information Technology and Vice President, Manufacturing and Commercial Operations and Information Technology. This function helps to identify, assess, and manage our cybersecurity threats and risks, including through the use of our risk register. Our information security function helps identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: evaluating our industry's risk profile, deploying manual and automated tools in certain environments, subscribing to reports and services that identify certain cybersecurity threats, evaluating certain threats reported to us, engaging third parties to conduct threat assessments, conducting internal and external vulnerability and threat scans and assessments of certain environments, conducting internal audits, and penetration testing of certain systems.

companyName: NeuroPace Inc

ticker: NPCE


text: As part of our risk management system, we track and log privacy and security incidents to facilitate our efforts to remediate and resolve any such incidents. Any significant incidents are reviewed with our Chief Financial Officer and incidents that are assessed as potentially being or potentially becoming material are escalated within the appropriate members of management and reported to our executive leadership team. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our executive leadership team makes the final materiality determinations and disclosure and other compliance decisions.

companyName: BioCardia, Inc.

ticker: BCDA


text: Our CAO, Aaron S.G. Merrick, has more than 25 years of experience in the technology sector and 16 years of experience in managing cybersecurity risk. Mr. Merrick was named CAO in 2022 and previously served as our Vice President – IT since 2016. Prior to joining Antero, he held IT leadership positions of increasing responsibility at Apache Corporation, including Director of IT from 2006 to 2009 and Vice President of IT from 2009 to 2015. Additionally, Mr. Merrick was President of a computer consulting business from 2002 to 2006, and he also held several positions of increasing responsibility at T-NETIX, Inc., including Vice President of IT, during his tenure from 1995 to 2000. Mr. Merrick graduated from Bob Jones University in 1984 with a Bachelor of Science degree in Accounting.

companyName: Antero Midstream Corp

ticker: AM


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our CIO and CISO, who are supported by other members of management, as necessary. Our CIO and CISO are responsible for approving budgets, cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing the Chief Financial Officer ("CFO") with regular updates on cybersecurity-related matters. Our CIO has served in this role for three years and has more than 28 years of relevant experience, including previous roles as the CIO for two companies and the divisional information technology leader for two companies. Our CISO, who reports to the CIO, has served in this role for two years and has more than 28 years of relevant experience, including a focus on information security and cybersecurity for the last 15 years. Our CISO was previously the CISO for another automotive supplier. In addition, our CISO is very engaged in the cybersecurity community through current and past involvement with organizations such as the chair of General Motors Supplier Automotive Community and a member of Automotive Information Sharing and Analysis Center, Michigan Infragard, Domestic Security Alliance Council and the European Association of Automotive Suppliers cybersecurity workgroup. In addition, we have an information security team comprised of dozens of employees dedicated to cybersecurity with extensive experience and relevant certifications. The CIO and CISO are responsible for hiring appropriate personnel, assisting with the integration of cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, and mitigating and remediating in the event of a cybersecurity incident. Our product cybersecurity risk assessment and management processes are implemented and maintained by E-Systems management, including the Division President; Vice President of Global Strategy, Product Management and Electronics Engineering; and Vice President of Product Integrity and Technology. Our product security team within our E-Systems business consists of a team of employees dedicated to product cybersecurity engineering.

companyName: LEAR CORP

ticker: LEA


text: We have implemented a Cybersecurity Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to cybersecurity incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process follows the National Institute of Standards and Technology framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all Company personnel, including third-party contractors, vendors and partners, that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company.

companyName: FORUM ENERGY TECHNOLOGIES, INC.

ticker: FET


text: Our risk assessment process involves periodic vulnerability assessments and monitoring of emerging threats. Our policies and procedures are designed to ensure compliance with relevant regulations, to consider industry practices, and we periodically review and update them to address evolving cybersecurity risks.

companyName: Ranger Energy Services, Inc.

ticker: RNGR


text: While the Board of Directors is ultimately accountable for risk management, the Audit Committee oversees management's processes for identifying, implementing, and mitigating cybersecurity threats. On at least a quarterly basis, the Senior Director of Information Security provides the Audit Committee with updates regarding the Company's ongoing cybersecurity program. These updates regularly cover the latest in the Company's evolving approach to managing cybersecurity risks, reviewing key metrics on the effectiveness of the program, and discussing recent developments, key strategic initiatives, the current threat environment, and outcomes from specific evaluations and tests.

companyName: BUCKLE INC

ticker: BKE


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. Our board of directors and the Audit Committee receive periodic reports from our Chief Information Security Officer ("CISO") on our cybersecurity risks. In addition, our CISO updates the Audit Committee, as necessary, regarding significant cybersecurity incidents or updates.

companyName: Hyatt Hotels Corp

ticker: H


text: As of December 31, 2024, the Company has not identified any cybersecurity threats, including previous incidents, that have materially impacted our business strategy, results of operations, or financial condition. This assertion signifies our diligent efforts in managing and mitigating cybersecurity risks, contributing to the stability and continuity of our operations.

companyName: Winvest Group Ltd

ticker: WNLV


text: Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology, or NIST, Cybersecurity Framework. We use various tools and methodologies to monitor and manage cybersecurity risks. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. Our Information Security Execution Team conducts annual tabletop exercises to ensure preparedness for information security, including cybersecurity, incidents. In addition, we promote a company culture of awareness and discipline in cybersecurity matters through annual employee training and education, including periodic phishing simulations.

companyName: Natera, Inc.

ticker: NTRA


text: The Company's Cybersecurity Leadership Team includes the CISO, Mr. Timothy Byrd. Mr. Byrd is responsible for overseeing and reporting on the development and implementation of the Company's information security program. Mr. Byrd has over twenty years of experience in information security for large financial institutions. He also served as chairman for the Bank Policy Institute's Technology Policy Division Information Security Committee and as a board member of Financial Services Information Sharing and Analysis Center. Mr. Byrd currently serves on the Advisory Council for New York University's Graduate School of Engineering, as well as the Advisory Board for University of North Carolina - Charlotte College of Computing and Informatics. The CISO reports to the Company's Chief Information Officer, Mr. Michael A. Wisler, who has two decades of experience in the financial and technology industries. Prior to joining the Company in 2018, Mr. Wisler served as Chief Technology Officer of North American Credit Cards and Chief Information Officer of Europe at Capital One Financial Corporation. He holds a Masters of Science in Management of Information Technology from the University of Virginia. In addition, the Cybersecurity Leadership Team includes management with expertise in vulnerability management, digital forensics, threat intelligence, software development, cybersecurity operations, and project management. Many individuals on the Cybersecurity Leadership Team hold cybersecurity-relevant certifications.

companyName: M&T BANK CORP

ticker: MTB


text: We have established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our senior leadership and executive team on a monthly basis. We have established an information security risk committee, chaired by our chief information security officer ("CISO") and comprised of employees and executive management, to, among other things, coordinate and communicate the direction, current state, security risks (gaps) and governance of our information security program. Our cybersecurity program in particular focuses on the following key areas: Collaboration

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: Cybersecurity Risk Management and Strategy We, through our third -party service provider that manages our information technology systems and networks, have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: FENNEC PHARMACEUTICALS INC.

ticker: FENC


text: To support the overall cybersecurity program, Alight maintains an incident management team that tracks and logs privacy and security incidents across Alight, our vendors, and partners to better manage remediation and resolution of any such incidents. Significant incidents are promptly reviewed by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is escalated for further review, and then reported to designated members of our executive leadership team where needed. We consult with outside counsel and forensics firms as appropriate, including on materiality analysis and disclosure matters, and members of our executive leadership team make the final materiality determinations and, if appropriate, disclosure to law enforcement, regulators or clients. Our executive leadership team apprises Alight's Board of Directors and our independent public accounting firm of significant matters and any relevant developments.

companyName: Alight, Inc. / Delaware

ticker: ALIT


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee of our board of directors is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Kezar Life Sciences, Inc.

ticker: KZR


text: Our Chief Information Security Officer ("CISO") leads our Global Security Organization. Our CISO supports our compliance with standards and contractual obligations relevant to cybersecurity and good risk governance. Our CISO has over ten years of experience focused on cybersecurity. Our CISO has degrees in computer science and management information systems, each with an emphasis on information security, and has certificates from the Global Information Assurance Certification program as an Information Security Professional and for Strategic Planning, Policy and Leadership. Our CISO has held senior positions focused on the management and operation of our cybersecurity risk management processes for over five years. In addition to its oversight, monitoring and other responsibilities, the Global Security Organization conducts an annual risk assessment process concerning our enterprise and product families. This process supports our prioritization, planning and execution of security program improvements. We also maintain a risk management process throughout the year designed to compile and manage risks through a variety of technical and administrative controls. Third-party cybersecurity risk management.

companyName: Informatica Inc.

ticker: INFA


text: To aide in assessing material risks from cybersecurity threats, our enterprise risk management ("ERM") program incorporates cybersecurity risks as part of its process to assess overall risk of the Company. The ERM organization supports management by facilitating a semi-annual risk assessment, which documents the priority and status of these risks and aligns them with our strategic mitigation efforts. ERM is structured using a framework based on guidance from the Committee of Sponsoring Organizations of the Treadway Commission on Enterprise Risk Management Integrating Strategy with Performance.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: Protecting data privacy and security is an organizational-wide responsibility. We protect customer data with a variety of processes and monitoring tools, such as:

companyName: FOXO TECHNOLOGIES INC.

ticker: FOXO


text: Our process for assessing, identifying, and managing material risks from cybersecurity threats is integrated into our overall risk management process. We have a robust enterprise risk management ("ERM") program that plays an important role in seeking to manage and address existing and emerging risks, including cybersecurity risks, which are critical to our overall business goals and objectives. The ERM team updates our CEO and his leadership team on cybersecurity risks as well as their potential impact, likelihood, potential mitigation plan, and status.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: The program is led by our CDIS, who operates under the direction of the CIO. With over 30 years of experience in IT and cybersecurity, the CDIS heads our global Information Security team and the Security Steering team. This multidisciplinary team comprises experts from IT, Infosec, Legal, Audit, and Risk. The CDIS brings extensive expertise across a diverse array of platforms, services, and technologies.

companyName: UNIVERSAL CORP /VA/

ticker: UVV


text: Board as a whole oversees our cybersecurity risk and receives reports from our management team on various potential cybersecurity matters, including areas of emerging risks, incidents and industry trends, and other areas of importance.

companyName: Yale Transaction Finders, Inc.

ticker: YTFD


text: Risks from cybersecurity threats, including any previous cybersecurity events, to-date have not materially affected and are not likely to materially affect the Company or its business strategy, results of operations or financial condition. Notwithstanding the approach that the Company takes to address cybersecurity risk via its vendors, the Company may not be successful in preventing or mitigating a future cybersecurity incident that could have a material adverse effect on the Company or its business strategy, results of operations or financial condition.

companyName: AIRWA INC.

ticker: YYAI


text: The Audit Committee of the Company's Board of Directors has oversight in the management of risks associated with cybersecurity. The Audit Committee is briefed regularly on cybersecurity matters, including meeting with the Company's Chief Technology Officer at least annually and receiving a memorandum quarterly regarding cybersecurity. In addition, the Audit Committee discusses cybersecurity with other members of management and the internal audit staff at each quarterly meeting. The Audit Committee reports to the full Board of Directors quarterly regarding cybersecurity.

companyName: Healthcare Realty Trust Inc

ticker: HR


text: The Company subscribes to a defense in depth strategy when it comes to cybersecurity and has processes in place to assist in the assessment, identification, and management of material risks from threats. Our cybersecurity strategy is largely guided by key principles and frameworks from the National Institute of Standards and Technology (NIST). The Company maintains technical and organizational safeguards, including employee training, incident response capability reviews, cybersecurity insurance and business continuity mechanisms for the protection of the Company's assets. From time to time, the Company's processes are audited and validated by internal and external experts. Semi-annually, the Company performs a risk mitigation assessment to assess and determine specific cybersecurity risks prevalent within the global information technology infrastructure and how those risks are mitigated. Further, through the use of an independent third-party service provider, the Company performs external penetration testing as well as internal network vulnerability testing to assess and identify gaps and vulnerabilities within the global information systems.

companyName: TITAN INTERNATIONAL INC

ticker: TWI


text: The Audit Committee of our Board of Directors has oversight responsibility for the policies, processes and risks relating to cybersecurity. A senior member of our internal control group attends all scheduled Audit Committee meetings and provides in-depth reports to the committee on cybersecurity risks and updates on the status of projects to strengthen the Company's cybersecurity systems and improve cyber readiness. Moreover, on a quarterly basis, a senior member of our internal control group reports to the Audit Committee and assists the committee with its review of relevant cybersecurity risks and evaluation and updating of our Cyber Risk Controls. Certain members of our Audit Committee have specific experience in information security and cybersecurity, and the Company has made cybersecurity training available to members of the Audit Committee.

companyName: ACACIA RESEARCH CORP

ticker: ACTG


text: DIRTT's Senior Vice President ("SVP") of Technology, who reports to the CEO, is responsible for DIRTT's cybersecurity and has over 15 years of technology experience. The SVP of Technology is supported by dedicated Cybersecurity staff and Governance, Risk and Compliance ("GRC") staff. DIRTT's cybersecurity team leader has over 20 years of experience in cybersecurity, multiple industry standard cybersecurity certifications, and extensive offensive and defensive cybersecurity tactical skills. DIRTT's GRC lead has over 20 years of GRC experience and industry standard certifications. Cybersecurity incidents, response and remediation activities and statuses are reported directly to the SVP of Technology.

companyName: DIRTT ENVIRONMENTAL SOLUTIONS LTD

ticker: DRTTF


text: Our Audit Committee is responsible for oversight of our cybersecurity measures, incident response management and risks related to cybersecurity and technology as well as the steps taken by management to mitigate such risks. Liberty Global's CSO provides periodic updates to the Audit Committee on the state of Liberty Global's cybersecurity posture, new threats or threat actors that the company is monitoring or developing defenses against and any potential areas of improvement. Our CEO, CTO, CSO and General Counsel will also provide ad hoc updates to the Audit Committee and full board of directors, as appropriate, in the case of a material cybersecurity incident, providing them a full briefing of the type and scope of the incident as well as the company's current and planned mitigation efforts. The Audit Committee has several members with significant direct and indirect cybersecurity experience, including Anthony Werner, the former CTO of Comcast Cable and the company, Paul Gould and Miranda Curtis CMG. Cybersecurity and the effectiveness of our cybersecurity strategy are regular topics of discussion at meetings of our Audit Committee and board of directors.

companyName: Liberty Global Ltd.

ticker: LBTYA


text: We have aligned our cybersecurity program to the National Institute of Standards and Technology's ("NIST") published cybersecurity standards, and our policies and processes are compliant with NIST Special Publication 800-171 and other applicable publications. Given our status as a defense contractor, we are subject to numerous regulations, including those pursuant to the Defense Federal Acquisition Regulation Supplement ("DFARS"), requiring us to have controls in place to protect U.S. government CUI and to report cybersecurity incidents to the DoD.

companyName: AeroVironment Inc

ticker: AVAV


text: performing risk assessments and producing security assessment reports that document the results of the assessment for use and review by information technology senior leadership, including the Chief Technology Officer;

companyName: KINGSTONE COMPANIES, INC.

ticker: KINS


text: We have established policies and procedures, including our Incident Response Plan ("IRP"), for assessing, identifying, managing, and responding to cybersecurity and privacy threats and incidents, including protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our IRP provides guidance in the event of a cybersecurity incident, including processes with assigned roles and responsibilities to triage, assess severity, escalate, contain, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. We conduct regular cybersecurity tabletop exercises to test established policies and procedures for responding to cybersecurity threats and incidents. In addition, employees and stakeholders can report cybersecurity threats, cybersecurity and data privacy incidents, or other concerns through external and internal reporting channels.

companyName: Baker Hughes Co

ticker: BKR


text: As a smaller reporting company with limited cash resources, we do not currently maintain formal cybersecurity policies, processes, procedures, or training programs. We do not have personnel specifically dedicated to cybersecurity risk management. We are aware of the importance of cybersecurity protections and intend to develop a more robust cybersecurity framework if financial and operational conditions permit.

companyName: Adapti, Inc.

ticker: ADTI


text: Material Effects from Cybersecurity Incidents Our business is subject to risk from cybersecurity threats and incidents, including attempts to gain unauthorized access to our systems or networks, or those of our managers, employees, and third-party vendors and service providers, to disrupt operations, corrupt data or steal confidential or personal information and other cybersecurity breaches. We consider cybersecurity risk a serious threat to our assets and our people and have put processes in place designed to mitigate the risk and impact of any such cybersecurity threat or incident.

companyName: Universal Token

ticker: UTKN


text: Cybersecurity Risk Management and Strategy Nordson Corporation manages cybersecurity risks by implementing processes for assessment, identification, and mitigation of cybersecurity threats. Nordson's cybersecurity program is designed to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, enabling us to develop policies regarding information access, asset protection and personal data security. However, this does not mean that we meet any particular technical standards, specifications or requirements, but rather that we use the NIST Cybersecurity Framework as a guide to help us identify, assess and manage cybersecurity risks and threats relevant to our business. We strive to protect our information assets through key cybersecurity measures, such as the implementation of multifactor authentication and advanced malware defenses, and we collaborate with internal stakeholders to establish layered cybersecurity defenses and restricted access based on business needs. We conduct regular continuous education sessions for our employees on cybersecurity awareness, including confidential information protection and simulated phishing attacks.

companyName: NORDSON CORP

ticker: NDSN


text: Under the ultimate direction of our Chief Executive Officer and executive management team, our risk committee (the "Risk Committee") has primary responsibility for overseeing the management of cybersecurity risks. It is chaired by our chief financial officer (the "Chief Financial Officer").

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: We expect risks from cybersecurity threats, including, but not limited to, security breaches, viruses, malware, ransomware attacks, other cyber-attacks, or other similar threats, to continue as events of this nature become more sophisticated and potentially more frequent, and the techniques used in such attacks change rapidly.

companyName: AZEK Co Inc.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We monitor various cybersecurity resources to remain informed about new and emerging cybersecurity threats and attack vectors. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer ("CISO"), who reports to our Executive Vice President of Platform Development, to manage the risk assessment and mitigation process.

companyName: Cricut, Inc.

ticker: CRCT


text: There have been no recent incidents of cybersecurity breaches within the Company's information systems in the past three fiscal years. For additional information, refer to the section entitled "The Company may be adversely affected by a disruption in, or failure of, information technology systems" within Item 1A Risk Factors.


text: As of the date of this report, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.

companyName: Janus International Group, Inc.

ticker: JBI


text: Management has established an incident response plan designed to assess, identify and manage risks from cybersecurity threats and enable prompt response in the event that a cybersecurity incident is detected. We have a process in place for notification to our leadership response team in the event of a significant cyber incident, and for escalation of these events to our Audit Committee and Board, as appropriate. To date, we have not experienced a cybersecurity incident that has had a material impact on our business strategy, results of operations, or financial condition.

companyName: Acorda Therapeutics, Inc.


text: We have established comprehensive incident response and recovery plans and continue to evaluate the effectiveness of those plans. Our incident response and recovery plans address — and guide our response to — a cybersecurity incident.

companyName: Strategic Storage Trust VI, Inc.

ticker: SGST


text: We use, store and process data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems and business operations.

companyName: Premier Air Charter Holdings Inc.

ticker: PREM


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, Oceaneering engages with a range of external support, including cybersecurity consultants, in evaluating, monitoring and testing our cyber management systems and related cyber risks. The Company's collaboration with these third parties includes audits, threat and vulnerability assessments, incident response plan testing, company-wide monitoring of cybersecurity risks and consultation on security enhancements.

companyName: OCEANEERING INTERNATIONAL INC

ticker: OII


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. While we have implemented a cybersecurity program, the techniques used to compromise IT systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information regarding risks relating to privacy and cybersecurity, see "Item 1A – Risk Factors."

companyName: INTERNATIONAL TOWER HILL MINES LTD

ticker: THM


text: Use of Third Parties The Company has engaged, and intends to continue to engage, nationally recognized third parties to assist the Company in assessing, among other things: • emerging cybersecurity risks; • threat identification; • threat neutralization; • cybersecurity environment testing; • penetration testing; • phishing and social engineering methods; and • best practices for continued compliance and training.

companyName: SANFILIPPO JOHN B & SON INC

ticker: JBSS


text: As of December 31, 2023, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, unauthorized transactions, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. See Item 1A, "Risk Factors - Risks Related to Our Business - Cybersecurity."

companyName: MODIV INDUSTRIAL, INC.

ticker: MDV


text: The CISO brings over 28 years of experience in Cyber Security and IT Controls, with the last 16 years serving as CISO of the Company and previously at Everest Insurance Corp. Prior experience includes several years at PricewaterhouseCoopers as an IT auditor and Cyber Security consultant. The CISO holds comprehensive Cyber Security accreditations and certifications, including CISSP, CISA, CRISC, CHP, CDRE, and MBCI, and has completed undergraduate degrees in Accounting and Computer Information Systems from Baruch College. The CISO oversees a department comprising five cyber security engineers with extensive experience.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: We recognize that third parties that provide information systems used by the Advisor to provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To mitigate third party risk, Franklin Templeton requires third party vendors to comply with our confidentiality, security, and privacy requirements. Third-party IT vendors are also subject to additional diligence such as questionnaires and inquiries.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: Cybersecurity risks are identified as key risks through the enterprise risk management (ERM) program. These risks could include use of malicious code, employee theft or misuse, advanced persistent threats, vulnerabilities, fraud attempts, and phishing attacks that could cause, among others, an operations or information technology system failure, or breach or loss of sensitive information. The potential impact of cybersecurity risks on our business operations, results of operations or financial condition is discussed in the " Risks Related to Business Operations " section of Item 1A " Risk Factors." We have not had any material cybersecurity breaches or incidents and have not incurred any material expenses, penalties or settlement costs related to any cybersecurity breaches or incidents. However, measures that we take to avoid, detect, mitigate or recover from cybersecurity breaches or incidents may be insufficient or become ineffective, and there are no assurances that cybersecurity breaches or incidents will not impact our business operations and strategy, results of operations and financial condition.

companyName: WISCONSIN POWER & LIGHT CO


text: The Company has established processes to assess, identify, and manage risks from cybersecurity threats as part of our broader enterprise-wide risk management system and processes, which is overseen by our Board of Directors through our Audit Committee, along with our executive management.

companyName: Citius Pharmaceuticals, Inc.

ticker: CTXR


text: As part of our overall strategic initiatives, we have made investments in internal and external resources to support and enhance our technology infrastructure over the next several years. As part of this technology transformation, we plan to continue to invest in our information security team, enhance our cyber response plan and data privacy policies and evolve our third-party risk management program. In addition, in connection with our strategic review of the Family Dollar business, we are conducting a comprehensive reassessment of our cybersecurity posture. This evaluation focuses on how these changes affect our people, processes, and technologies. By doing this, we ensure the ongoing protection of sensitive data and critical assets, while also maintaining alignment with our security standards.

companyName: DOLLAR TREE, INC.

ticker: DLTR


text: The Audit Committee of our Board of Directors (the "Audit Committee") is responsible for the oversight of risks from cybersecurity threats. Our management team, including our EVP Product and Technology, reviews and discusses a summary of our cybersecurity posture with the Audit Committee on a periodic basis. When covered during an Audit Committee meeting, the chairman of the Audit Committee reports on its discussion to the full Board of Directors.

companyName: MARIN SOFTWARE INC


text: We are committed to maintaining effective governance and oversight of cybersecurity risks. Our cybersecurity strategy focuses on implementing effective and efficient mechanisms, controls, technologies, systems and other processes across our global IT networks and systems to assess, identify and manage material risks from potential unauthorized occurrences on or through our IT systems that may result in adverse effects on the confidentiality, integrity or availability of our IT systems and the data residing therein. These processes are designed to promote (i) robust controls across our IT ecosystem, (ii) transparency across our IT infrastructure so that our information security team can detect, identify and escalate anomalies for further analysis and action, and (iii) a sound enterprise security architecture with security integrated into each phase of system implementation. We believe that the processes and controls we have established to protect our stakeholders' interests, including with respect to our current regulated products and internal systems, are robust and generally aligned with applicable cybersecurity regulations and informed in part by certain industry standards, principles and frameworks, such as those set by the National Institute of Standards and Technology. This includes security by design, regular penetration testing, vulnerability scanning and standardization where possible of cybersecurity architecture principles.

companyName: QuidelOrtho Corp

ticker: QDEL


text: For additional information regarding how cybersecurity threats or incidents are reasonably likely to materially affect our business strategy, results of operations or financial condition, see "Risk Factors—A failure in or breach of our information systems or infrastructure, or those of third parties with which we do business, including as a result of cybersecurity incidents or threats, could disrupt our businesses, lead to reputational harm and legal liability or otherwise impact our ability to operate our business" and "Risk Factors—Other operational risks may disrupt our businesses, result in regulatory action against us or limit our growth."

companyName: Lazard, Inc.

ticker: LAZ


text: implementation of internal policies and procedures, including an Information Security and Acceptable Use Policy, Information Security Management System Policy, Cyber Incident Response Procedures and Cyber Security Assessments on Policies and Procedures, to manage cybersecurity risk, implement incident reporting procedures and cybersecurity threat responses and regularly assess and monitor the Company's cybersecurity measures;

companyName: DORIAN LPG LTD.

ticker: LPG


text: Response. Occurs when a security incident is a confirmed data breach; when a security incident requires the Company to take further action to protect the organization and/or affected parties whose impacted personal information is at risk or has been compromised; or when additional administrative, physical, or technical controls are needed after a security incident. In the Response phase, the priority is to swiftly complete required notifications and other procedures according to applicable law.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF