text: Our ITSS team is led by our CISO, who reports to our Executive Vice President and Chief Financial Officer. Our CISO is a former CPA that has 34 years of experience in leading global accounting and business information systems groups including strategy, applications, infrastructure, information security, support, and execution.

companyName: MICROCHIP TECHNOLOGY INC

ticker: MCHP


text: In coordination with third-party consultants, we have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical systems and data. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program and employee training. We conduct annual reviews and tests of our information security program to evaluate its effectiveness and improve our security measures and planning.

companyName: NEUROONE MEDICAL TECHNOLOGIES Corp

ticker: NMTC

secItem: Item 1C


text: The Company relies on the Investment Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Investment Adviser's risk management program and processes, which include cyber risk assessments.

companyName: WhiteHorse Finance, Inc.

ticker: WHF


text: We rely extensively on various information systems, operated by us as well as third-party service providers, to manage many aspects of our business. We are susceptible to a number of significant and persistent cybersecurity threats, including those common to most industries as well as those we face as a retailer, operating in an industry characterized by a high volume of customer transactions and collection of sensitive data. These threats, which are constantly evolving, include data breaches, ransomware, and phishing attacks. We, and our vendors and suppliers, regularly face attempts by malicious actors to breach our security and compromise our information technology systems, and a cybersecurity incident impacting us or any vendor or supplier could significantly disrupt our operations and result in damage to our reputation, costly litigation and/or government enforcement action.

companyName: Torrid Holdings Inc.

ticker: CURV


text: As we currently do not have an audit committee or compensation committee, our Chief Executive Officer and Chief Financial Officer are responsible for overseeing cybersecurity risk and periodically updates our Board of Directors on such matters. The Board of Directors receives periodic updates from management regarding cybersecurity matters, and are notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: SHARING SERVICES GLOBAL Corp


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " If our security applications are breached by cyberattacks or are not adequate to address changing market conditions and customer concerns, we may incur significant losses and be unable to sell our services " included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10 -K.

companyName: Usio, Inc.

ticker: USIO


text: W. P. Carey 2024 10-K – 20 Additionally, the Audit Committee, which consists solely of independent directors, is responsible for overseeing cybersecurity risks and related initiatives. The Audit Committee reviews our enterprise risk and cybersecurity risks. It also reviews the steps management has taken to protect against threats to our information systems and security and receives updates on cybersecurity on a quarterly basis.

companyName: W. P. Carey Inc.

ticker: WPC


text: Risk Management and Processes is actively working towards the integration of a cybersecurity risk management program into its comprehensive risk management framework to protect the confidentiality, integrity, and availability of its critical systems and information.

companyName: Sensus Healthcare, Inc.

ticker: SRTS


text: Our internal data privacy and data security team evaluates vendors that have access (directly or indirectly) to our data and/or systems to help us document and mitigate potential cybersecurity threats associated with our use of those vendors and the products and services they provide. These evaluations also include how these vendors may incorporate generative artificial intelligence and other similar artificial intelligence tools into their offerings.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: The Company engages with third-party experts, including cybersecurity focused Security Operations Center (SOC) and leading-edge EDR providers, to assist in evaluating and detecting security risk and initiate corrective actions. These partnerships enable the Company to leverage specialized knowledge and insights, ensuring cybersecurity strategies and processes remain aligned with industry best practices. The collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: LIFETIME BRANDS, INC

ticker: LCUT


text: Processes to oversee and identify material risks associated with use of third-party service providers Cleco implemented and is optimizing processes to manage the cybersecurity risks associated with its use of third-party software service providers. Additionally, Cleco proactively reviews and updates all third-party software service contracts upon renewal for potential amendments related to security, confidentiality, and recourse in the event of a negligent incident, such as a breach, loss, or unauthorized use of Cleco's data. These measures provide the structure for managing Cleco's cyber-related risks.

companyName: Cleco Corporate Holdings LLC


text: Violations or breaches of our Cybersecurity Policy or the associated schedules, standards or guidelines may result in suspension and/or discipline up to and including termination, in addition to administrative sanctions or legal actions.

companyName: U.S. GoldMining Inc.

ticker: USGO


text: We recognize the importance of data privacy and security and are committed to safeguarding and protecting our own confidential information and other confidential information shared with us. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of all our critical systems and information, which is integrated into our overall risk management program. This cybersecurity risk management program involves the strategic planning, operation, implementation and monitoring of cybersecurity practices within our organization. Our cybersecurity program also includes a comprehensive incident response plan ("IRP") to respond to security breaches and cyberattacks.

companyName: Prestige Consumer Healthcare Inc.

ticker: PBH


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third -party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security (including our consumer products) and implement appropriate changes.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer and Senior Director of IT and Security. Such individuals have over 30 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to our sole director about cybersecurity threat risks, among other cybersecurity related matters, on a regular basis.

companyName: NETLIST INC

ticker: NLST


text: Notwithstanding the measures we have put in place internally and through third party industry experts, on October 15, 2025, we learned that a threat actor had gained unauthorized access to portions of our information technology ("IT") environment and claimed to have unlawfully accessed certain Company information and data. We immediately activated our cyber incident response plan to contain the intrusion, assess and investigate the incident and implement remedial measures. We also immediately notified law enforcement, including the Federal Bureau of Investigation (FBI), and retained external cybersecurity experts to assist. Based on our investigation to date, we believe that the cybersecurity incident consisted of unauthorized access and deployment of encryption and monitoring software by a third party to a portion of our internal corporate IT systems.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: Management ' s Role Our cybersecurity program is coordinated by our Vice President Director of Information Security, who reports to our Senior Vice President Chief Risk Officer and Chief Administrative Officer, in partnership with our Director of Information Systems and Technology ("IS&T"). Our Director of Information Security started with us in 2012 and holds numerous credentials including: Certified Information Systems Security Professional, Certified Public Accountant, and Certified Fraud Examiner. The Director of Information Security is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from the IS&T team and our Managed Services Provider, who is overseen by the Director of IS&T. The Director of IS&T started with us in 2020, holds a Bachelor of Science in Business Administration, Information Technology and has over 14 years of direct experience managing information systems and technology. The Director of IS&T is responsible for implementing and maintaining the systems and tools to protect the technology stack we use. The Director of IS&T reports to the Senior Vice President, Chief Operating Officer.

companyName: Eagle Bancorp Montana, Inc.

ticker: EBMT


text: UScellular identifies risks across the threat and vulnerability landscape using various commercial, government, vendor and publicly available information sources and tools. Risks related to third-party providers who have access to UScellular data and systems are identified, assessed and managed through a formal third-party risk assessment process. Third-parties who access sensitive company or customer information are contractually obligated to meet specific privacy and security requirements. The UScellular security operations program includes active monitoring of the internal data environment and regular assessment of the environments of third-party service providers who manage sensitive data. In addition, UScellular security leaders conduct regular cyber incident simulations to ensure preparedness in the event of a cyber-attack and further test potential risks. Identified risks are evaluated against a risk classification framework to direct remediation, mitigation and management efforts based on severity. Cybersecurity risks are integrated into the UScellular Enterprise Risk Management (ERM) program with updates provided on a quarterly basis.

companyName: ARRAY DIGITAL INFRASTRUCTURE, INC.

ticker: AD


text: The Company is subject to cybersecurity risks related to its business partners and third-party service providers, as further detailed under the heading "Increasing privacy, data security and cybersecurity obligations or a significant data breach may adversely affect the Company's business" included as part of our risk factor disclosures in Part I, Item 1A. of this report. To manage these risks, the Company has integrated third-party incidents into its cybersecurity incident response processes. The Company also conducts evaluations and assessments of key suppliers based on risk and seeks to incorporate appropriate measures to manage the risk. The Company also regularly monitors the external cybersecurity posture of thousands of third parties through various service providers.

companyName: United Airlines Holdings, Inc.

ticker: UAL


text: Periodically throughout the year, the CIO briefs the Audit Committee and Board on cybersecurity activities and long-term cybersecurity strategies, as well as general cybersecurity trends that could have a material impact on the Company. At any time, the Company Board members may raise concerns regarding the Company's cybersecurity posture and recommend future changes to controls or procedures.

companyName: Utz Brands, Inc.

ticker: UTZ


text: Oversee Third-party Risk Aware of the potential risks posed by third-party service providers, our Company takes steps to perform security-related diligence on such providers. This diligence process aims to understand and evaluate the security measures and practices of our third-party partners. Our approach includes reviewing available information and seeking insights into their security and data management practices. This method is part of our broader strategy to mitigate the risks associated with data breaches or other security incidents that may arise from third-party engagements.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH


text: To further protect our business, we partner with a third party vendor to provide cybersecurity and risk management as a managed service offering. They provide cybersecurity risk assessment and threat intelligence to the Company, in addition to acting as a managed service provider for our information technology program. We decided to retain a third party for these services given the small size of our Company and internal information technology staff and the quality, comprehensiveness, and cost-effectiveness of the services offered. An internal team, led by our Chief Operating Officer, oversees and works collaboratively with this third party vendor to evaluate the strength of our cybersecurity protocols and the results of testing to determine what additional actions, such as trainings or remedial actions, are necessary to lessen cybersecurity risks. We intend to continue to make investments to monitor and maintain the security of our data and cybersecurity infrastructure.

companyName: Vita Coco Company, Inc.

ticker: COCO


text: Technology Risk Committee Members of the Technology Risk Committee include officers with expertise in cybersecurity risk oversight, such as the Chief Information Security Officer described above, the head of our Technology Risk Oversight department, and the Chief Technology Officer. As of December 2023, a pproximately three-quarters of the members of the Technology Risk Committee had prior work experience in cybersecurity, a relevant degree or certification, or other knowledge, skills or background in cybersecurity.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: Board of Director Oversight Our Board has delegated oversight of risks from cybersecurity threats, as well as overall Enterprise Risk Management, to our audit committee. The audit committee reviews and evaluates the effectiveness of our cybersecurity frameworks, policies, programs, opportunities and risk profile, as well as our business continuity and disaster recovery efforts. Members of our audit committee have cybersecurity experience from their principal occupation or other professional experience. Members of information technology management, including our CISO, regularly report on our cybersecurity matters to both the audit committee of our Board and the full Board, as follows: • Management provides quarterly reports to the audit committee regarding our cybersecurity program and risks, and the audit committee in turn provides reports to the full Board as needed. All incidents with critical functional impact are escalated to the Board and audit committee. • Current information security concerns that arise during the year are escalated in real-time to leadership based on the process defined in our Incident Response Plan. All events and incidents are evaluated against our prioritization and informational impact matrices outlined the plan.

companyName: Sunnova Energy International Inc.

ticker: NOVAQ


text: Trustmark's information security program is primarily administered at the management level by the Information Security Department, which is led by Trustmark's Chief Information Security Officer (CISO), and is supported by the Information Technology Department, which is led by Trustmark's Chief Information Officer (CIO). The CISO reports to the CIO, who in turn reports to Trustmark's Chief Credit and Operations Officer. Trustmark's Information Security Department is responsible for day-to-day management of Trustmark's information security program, including data loss prevention, access control, threat monitoring, incident response and employee education and training. The Information Security Department also maintains policies related to cybersecurity and data security that provide the required governance for the information security program. Additionally, Trustmark's Information Technology Department maintains policies that govern technical aspects of Trustmark's information security program. Each policy is reviewed and approved by the Enterprise Risk Committee at least every three years and is mapped to applicable regulatory guidance. The Cybersecurity Operations team within the Information Technology Department maintains and runs Trustmark's security operations center and is responsible for cybersecurity event management and maintaining security tooling. Trustmark also maintains an Information Security / Cybersecurity Management Committee, which is comprised of representatives from the Information Security, Information Technology, Enterprise Risk, Corporate Security, Internal Audit and Legal departments and members of executive management. This committee meets quarterly to discuss and review Trustmark's information security program and receives qualitative and quantitative update reports from the Information Security Department, Internal Audit Department and Information Technology Department.

companyName: TRUSTMARK CORP

ticker: TRMK


text: Prior to December 2023, our entire Board oversaw cybersecurity risk management, and our CIO and CISO reviewed our cybersecurity risks and risk management program and activities with the Board at least annually. The Board also received additional updates on changes in our cybersecurity risks and related risk management program and activities from time to time throughout the year, as warranted. Management also shared, and will continue to share, the results of our annual enterprise risk assessment, which includes a review of cybersecurity risk, with our full Board.

companyName: IDEXX LABORATORIES INC /DE

ticker: IDXX


text: Based on an assessment using these processes, we do not believe that there are currently any risks from known cybersecurity threats that are reasonably likely to materially affect our company or our business strategy, results of operations or financial condition. For additional information, please see the risk factor titled "Our internal computer systems, or those of our third-party vendors, collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business." under Item 1A., Risk factors—General risk factors, in this Annual Report on Form 10-K.

companyName: Beam Therapeutics Inc.

ticker: BEAM


text: The CFO and CEO play a pivotal role in informing the Audit Committee on cybersecurity risks. The CFO, in his capacity, regularly informs the CEO of all aspects related to cybersecurity risks and incidents ensuring the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. They provide briefings to the Audit Committee as needed, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.

companyName: City Office REIT, Inc.


text: We invest in our cybersecurity defenses and have implemented multiple layers of protection against all known critical threats. We have high levels of compliance to protective controls on our technical estate, robust perimeter defenses, industry-leading filtering and analysis of web and email traffic, widespread multi-factor authentication, continuous training of our employees through educational material or simulation (e.g., phishing) and 24/7 monitoring of the IT estate. We have a robust and up-to-date Cyber Incident Response Plan ("CIRP") that is performed as a table-top exercise at least annually. A range of dashboards has been designed for use by the cybersecurity management team to monitor the day-to-day performance of the cybersecurity defenses and immediately remediate any sign of concern.

companyName: GXO Logistics, Inc.

ticker: GXO


text: Our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.

companyName: MOBIVITY HOLDINGS CORP.

ticker: MFON


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on its Chief Compliance Officer ("CCO") and the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with its use of such entities.

companyName: Barings BDC, Inc.

ticker: BBDC


text: Our company has engaged a third-party managed detection and response company to monitor the security of our information systems around-the-clock, including intrusion detection, and to provide instantaneous alerting should a cybersecurity event occur. If a cybersecurity threat or cybersecurity incident is identified through our company's information systems, the CISO and Incident Response Team ("IRT") will take immediate steps to mitigate the threat and assess any damages. Upon report from the CISO, the SMT will evaluate the materiality of the cybersecurity threat or cybersecurity incident to determine if any public disclosures are required under the Security and Exchange Commission's cybersecurity disclosure rule. If deemed necessary, third-party consultants, legal counsel, and assessors will be engaged to evaluate the materiality assessment.

companyName: MERCANTILE BANK CORP

ticker: MBWM


text: We devote significant resources to protecting and evolving the security of our computer systems, software, networks and other technology assets. Our cybersecurity risk management processes include physical, procedural and technical safeguards. Our cybersecurity policies, standards and procedures include cyber and data breach response plans, which are benchmarked against the National Institute of Standards and Technology Cybersecurity Framework. The Company's incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations. The Company seeks to continually improve its policies and practices to identify potential and emerging security risks and develop mitigations for those risks. For example, the Company regularly conducts phishing tests, penetration tests and tabletop simulations to help discover potential vulnerabilities, which enable improved decision-making and prioritization and promote monitoring and reporting across compliance functions. As part of its overall risk mitigation strategy, the Company also maintains cyber insurance coverage.

companyName: LL Flooring Holdings, Inc.


text: Company or its legal counsel filed reports of these incidents with appropriate regulatory and enforcement agencies in the appropriate jurisdictions.

companyName: Value Exchange International, Inc.

ticker: VEII


text: The Company's cybersecurity risk management program and strategy are regularly reviewed and updated to ensure that they are aligned with the Company's business objectives and are designed to address evolving cybersecurity threats and satisfy regulatory requirements and industry standards.

companyName: TEXAS CAPITAL BANCSHARES INC/TX

ticker: TCBI


text: The Board established the Cyber Security Committee of the Board in December 2022 to augment the Board's oversight with cybersecurity focus and expertise and to complement the risk framework activities of the Enterprise Risk Management and Credit Policy Committee. The Cyber Security Committee considers risks associated with Horizon's overall cyber security and information technology programs; information technology audits; the security risk insurance that Horizon maintains for information technology, cyber security and privacy risks; Horizon's information security training programs; and compliance with all rules and regulations and risk control policies and procedures relating to information technology and cyber security. Pursuant to the Cyber Security Committee Charter, the Cyber Security Committee is required to meet at least three times per year and report to the Board annually. The Cyber Security Committee met three times in 2023. In addition, the Cyber Security Committee Charter provides that a majority of the Cyber Security Committee's voting members must qualify as independent directors under SEC rules and NASDAQ listing standards. During 2023, 80% of the Cyber Security Committee's members qualified as independent.

companyName: HORIZON BANCORP INC /IN/

ticker: HBNC


text: The Company engages third-party cybersecurity consultants and auditors who help the cybersecurity team in identifying, assessing, and managing material risks from cybersecurity threats, including by evaluating and enhancing the Company's cybersecurity posture. The Company also engages third-party service providers to perform a variety of functions throughout its business. The Company performs due diligence before engaging with certain third-party service providers designed to evaluate the service providers' cybersecurity practices, including their security policies, incident response capabilities, and data protection measures; including specific cybersecurity requirements in contracts with certain third-party service providers, such as regarding security standards, data protection, and incident reporting as applicable; and monitoring and auditing certain third-party service providers' cybersecurity practices and compliance with contractual obligations. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, the Company's vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Willdan Group, Inc.

ticker: WLDN


text: As part of the cybersecurity program, the Company's cybersecurity environment is monitored by automated tools on an ongoing basis and an internal cybersecurity team that reviews threats, alerts, and incidents. The Company's Incident Response Plan provides governance and guidance in responding to information security incidents and is tested regularly for calibration against existing and emerging threats. The Incident Response Plan describes the process to be followed by the Cyber Committee in connection with the oversight of the cybersecurity environment and specific events that occur from time to time. The cybersecurity program undergoes periodic internal and external reviews. In addition, the Company's Internal Controls Department performs an independent assessment of the design and operating effectiveness of the Company's network of cybersecurity controls in accordance with the NIST Framework. The results of the assessment are periodically shared with the Cyber Committee.

companyName: MOODYS CORP /DE/

ticker: MCO


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a cybersecurity team principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents; • the use of external service providers and software, where appropriate, to monitor, assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees; • a global incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers and suppliers.

companyName: Callaway Golf Co

ticker: CALY


text: The Company's Cyber Security Operations Center ("CSOC") serves as the central point for all cybersecurity incidents and reporting, including incidents that directly target employees or Dow internal information systems and incidents originating from third parties. The CSOC provides end-to-end operations for purposes of monitoring, detecting, alerting and responding to cybersecurity incidents. The CSOC evaluates each incident in terms of its impact on the Company's operations, ability to conduct business with customers and suppliers, brand reputation and health, safety or the environment, and the speed and degree to which the incident has been contained. The CSOC is also responsible for activating the containment and resolution efforts and third-party service providers are engaged where appropriate to support the Company through the resolution of the incident. The CSOC escalates incidents with significant impact and pervasiveness to the Company's Corporate Crisis Management Team for further action. After initial identification, the CSOC monitors all cybersecurity incidents for changes in degree of impact or pervasiveness.

companyName: DOW INC.

ticker: DOW


text: The Audit Committee receives reports quarterly from our CISO concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. Our Board of Directors also receives periodic reports from our CISO or Audit Committee regarding our overall cybersecurity program.

companyName: Fossil Group, Inc.

ticker: FOSL


text: AIR's Senior Vice President of Technology, in coordination with other members of AIR's management, is responsible for leading the assessment and management of cybersecurity threats. AIR has implemented a governance program for its cybersecurity efforts. This includes regularly updating privacy notices, terms of use, and lease documents, as well as identifying responsible teammates to facilitate the implementation of cybersecurity priorities. These teammates report regularly to senior management and to the Board on risk identification, safeguards, and mitigation steps. AIR has developed and implemented policies to identify and mitigate cybersecurity risks and provides training to teammates at onboarding and annually thereafter. Updates are communicated to all teammates, and actionable guidance is provided when new risks arise.

companyName: Apartment Income REIT Corp.


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems the Adviser uses to provide services to us pursuant to the Amended and Restated Investment Advisory Agreement, Franklin Templeton's cybersecurity team utilizes a regularly updated cybersecurity incident response plan that was developed based on, and is periodically benchmarked to, applicable third-party cybersecurity standards and frameworks. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the response team is led by the CISO or their delegee. In addition, senior officers of the Company have implemented a Company policy that supplements the Franklin Templeton incident response plan with respect to cybersecurity incidents that have or may impact the Company, including by impacting the Adviser's ability to provide services to the Company pursuant to the Amended and Restated Investment Advisory Agreement. Pursuant to this policy, the Adviser and Franklin Templeton are required to notify and update the Company's senior officers and our Audit Committee with respect to certain matters related to cybersecurity incidents specified under the policy.

companyName: Franklin BSP Capital Corp

ticker: FRBP


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for key service providers, suppliers, and vendors.

companyName: Walker & Dunlop, Inc.

ticker: WD


text: Technical Safeguards The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: Quad/Graphics, Inc.

ticker: QUAD


text: Oversight of cybersecurity is a joint responsibility of our Board of Directors and Audit Committee, with each receiving at least quarterly updates on our cybersecurity program, including measures taken to address cybersecurity risks and significant cybersecurity incidents. The Board and Audit Committee also may receive updates on topics such as the results of various cybersecurity assessments, third party risk management, and evolving risks.

companyName: STARWOOD PROPERTY TRUST, INC.

ticker: STWD


text: The Audit Committee regularly receives updates from management with respect to the Company's efforts to manage data protection, cybersecurity, and information and technology risks, and assesses the results of reviews from internal audits. Materials presented to our Audit Committee include updates on our data security posture, results from internal audit and third-party assessments, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The committee also regularly engages with our Group IT Manager on technology risk-related topics.

companyName: VOLITIONRX LTD

ticker: VNRX


text: The ability to mitigate cybersecurity risks is dependent upon an effective risk assessment process that identifies, measures, controls, and monitors material risks stemming from cybersecurity threats. These threats include any potential unauthorized activities occurring through the Company's information systems that could adversely affect the confidentiality, integrity, or availability of the Company's information systems or the data contained therein. The Company's Information Security Program includes a comprehensive information security risk assessment process that incorporates the following elements:

companyName: First Financial Northwest, Inc.


text: We have implemented internal controls including regular risk assessments designed to address financial, operational and information technology (including cybersecurity) risks and controls across our organization. These assessments are overseen by our Director of IT and VP of Finance. We implement cybersecurity controls and procedures designed to address cyber risks and threats, supported by third-party technologies and security advisors and providers. We also provide cybersecurity awareness training to our employees during the onboarding process and periodically thereafter. In addition, we engage external third-party information security consultants to periodically conduct information security testing and assessments, and to evaluate our overarching information security program and specific incident response procedures. We also maintain a Cyber Incident Response Plan, which is overseen by our Director of IT and is designed to coordinate our response to information security incidents.

companyName: Compass Therapeutics, Inc.

ticker: CMPX


text: Processes for managing cybersecurity risks The cybersecurity team tracks risks and incidents related to cybersecurity until the risk is mitigated to an acceptable level or fully remediated. When risks are identified, the cybersecurity team oversees mitigation plans with the risk owner which are communicated to necessary teams and remediation steps are taken.

companyName: EXACT SCIENCES CORP

ticker: EXAS


text: With respect to cybersecurity risk, we have a dedicated security engineering and operations team, supplemented with security consultants and two managed security service providers, that performs first line responsibilities by identifying security risks, deciding if and how to implement security tools and controls, and implementing and maintaining those tools and controls. This team is led by our Director of Technical Services, who has over 30 years of information technology experience, and reports to our Chief Information Officer (CIO), who has over 40 years of information technology experience. We also have an information security governance team that is responsible for performing second line responsibilities, including training associates, providing advice to our associates in carrying out their responsibilities consistent with the goals of the security program, assessing whether the program is reasonably designed and operating effectively, and responding to and reporting to stakeholders on the reasonableness and effectiveness of the security program. The information security governance team is led by our Chief Information Security Officer (CISO), who is a Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP) and has almost 40 years of experience in the field of cybersecurity. Our CISO reports directly to our Chief Legal Officer and General Counsel. Together, these teams maintain a robust information security program that utilizes a multi-layered defense-in-depth strategy and is designed to prevent, detect, mitigate and remediate cybersecurity incidents.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: Our cybersecurity risk management processes include: risk assessments performed by internal personnel and third-party advisors designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology environments information security teams principally responsible for developing and implementing (1) cybersecurity risk assessment processes, (2) information security controls, and (3) response plans to cybersecurity incidents the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our information security controls cybersecurity awareness training and policies designed to address social engineering attacks targeting employees and contractors cybersecurity incident response plans that include procedures for responding to and reporting, if applicable, certain cybersecurity incidents risk management processes for third-party service providers, suppliers, and vendors We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our results of operations, financial condition, cash flows and/or prospects.

companyName: SEMPRA

ticker: SREA


text: In an effort to ensure that our associates are knowledgeable about our data security and protection policies, and to enable them to proficiently handle the threat of cyber-attacks, all associates are required to participate in a cybersecurity awareness training program annually. Financial, IT and other associates who have access to sensitive information are also required to attend additional training courses during the year. We also conduct frequent phishing simulations throughout the year to test our employees' responses to suspicious emails and to better inform our cyber awareness training program.

companyName: Childrens Place, Inc.

ticker: PLCE


text: In addition, the Company maintains specific policies and practices to mitigate third party security risks, including a process for evaluating the security controls of vendors and service providers who exchange data with the Company or have access to or integrate with the Company's systems. At the same time, the Company's control over the security posture of third parties is limited and there can be no assurance that any partner of the Company will not experience a compromise or failure in the information assets under its control.

companyName: BLACKBERRY Ltd

ticker: BB


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, key elements of the Cybersecurity Program are subject to review by an independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: Cybersecurity operations generally fall under the discretion of the IT Director, who has 20 years of experience and is a Certified Secure Infrastructure Specialist (CSIS - Comptia) and IT Operations Specialist (CIOS - Comptia). Our IT Director regularly communicates with and provides relevant cyber reporting, analysis, statistics and statuses to the Chief Financial Officer, who also has a background in IT and is a Certified Information Systems Auditor.

companyName: Southland Holdings, Inc.

ticker: SLND


text: STERIS has an Executive Cybersecurity Steering Committee consisting of the Senior Vice President & Chief Financial Officer, the Vice President, Chief Accounting Officer, the Vice President, Investor Relations & Corporate Communications, the Vice President & Chief Information Officer ("CIO"), the Vice President, Chief Compliance Officer, the Senior Vice President, General Counsel & Company Secretary, and the Chief Information Security Officer ("CISO") that is responsible for providing governance, risk and compliance oversight for STERIS's incident response program, providing guidance and support for cybersecurity non-technical initiatives, and for verifying that appropriate actions are taken following an incident occurrence. We have adopted and maintain an incident response policy that covers our incident response program and the duties and responsibilities of our Incident Response Team ("IRT") responsible for managing and responding to cybersecurity incidents, including data breaches. Our IRT is led by the CISO and is comprised of senior management and others, including external resources, as required. Our incident response policy includes steps for detecting and investigating cybersecurity incidents, assessing the nature, scope, and severity of cybersecurity threats, identifying the impact of cybersecurity incidents, communicating cybersecurity incident disclosures, and implementing cybersecurity countermeasures and mitigation strategies.

companyName: STERIS plc

ticker: STE


text: 26North has also developed an incident response plan that provides guidelines for preparing for, responding to and recovering from cybersecurity incidents, and facilitates coordination across multiple operational functions. The incident response plan includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response plan includes notification to the applicable members of 26North's technology leadership team, including 26North's Chief Financial Officer ("CFO") and Chief Technology Officer ("CTO"), and, as appropriate, escalation to an internal ad-hoc group of senior employees, tasked with helping to manage the cybersecurity incident.

companyName: 26North BDC, Inc.


text: Our centrally defined security policies and processes are based on industry best practices and are revisited regularly to ensure their appropriateness based on risk, threats and current technological capabilities. We monitor compliance with these policies and processes through frequent internal audits and a set of robust metrics that assist in protection of our environment. As a U.S. defense contractor, we are additionally obligated to comply with current Department of Defense regulations such as Defense Federal Acquisition Regulation Supplement and the evolving Cybersecurity Maturity Model Certification guidelines.

companyName: TEXTRON INC

ticker: TXT


text: Cyber Incident Response and Reporting. The Company's Security Incident Response Policy is designed to enable prompt and effective action in the event of a cybersecurity incident to safeguard the Company's information technology systems, customer data and overall business operations. The Company is cognizant of the ever-evolving landscape of cybersecurity threats and their potential to materially impact the Company's operations. To date, the Company does not believe that it has experienced any cybersecurity incidents that have had a material adverse effect on the Company's business strategy, operations or financial condition. However, the Company recognizes that cybersecurity threats are a significant risk factor for any organization, especially those involved in digital infrastructure. See Part I, Item 1A, "Risk Factors," for further discussion.

companyName: EVgo Inc.

ticker: EVGO


text: Management is responsible for the overall implementation and effectiveness of the cybersecurity program. This includes allocating resources, establishing policies, and ensuring employee adherence to security practices. The VP of Information Security leads the cybersecurity team and reports directly to the VP of Cloud Infrastructure.

companyName: C3.ai, Inc.

ticker: AI


text: Management oversees the implementation and enforcement of cybersecurity policies, procedures, and technical safeguards. This requires clear communication to employees and ongoing monitoring of compliance.

companyName: DecisionPoint Systems, Inc.


text: from Material Cybersecurity Threats we have taken steps to prevent and mitigate data security threats, there can be no assurance that our protective measures and those of our third party service providers will prevent or detect security breaches that could have a significant impact on our business, reputation, operating results and financial condition. We maintain cyber liability insurance; however, this insurance may not be sufficient to cover the financial, legal, business or reputational losses that may result from an interruption or breach of our systems. As of the date of this filing, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on our business strategy, results of operations or financial condition. Although we have not experienced cybersecurity incidents that are individually, or in the aggregate, material, we have experienced cyberattacks in the past, which we believe have thus far been mitigated by preventative, detective, and responsive measures we have put in place. See the factors described in the "Part I. Item 1.A. Risk Factors " section of this Form 10-K for further detail about the cybersecurity risks we face. Maintaining a robust information security system is an ongoing priority for us and we plan to continue to identify and evaluate new, emerging risks to data protection and cybersecurity both within our Company and through our engagement of third-party service providers.

companyName: Xtant Medical Holdings, Inc.

ticker: XTNT


text: Our approach to managing cybersecurity risk involves a comprehensive program established at each subsidiary. This strategy intends to pinpoint subsidiary-specific risks associated with both our digital and physical assets with the objective of employing effective measures that ensure the security of our infrastructure, systems, data, business partners, customers, and financial information against potential cyber incidents. Corporate management of the holding company oversees the cybersecurity risk program at each of the subsidiaries to ensure the collective cohesively responds to organization-wide risks.

companyName: ARGAN INC

ticker: AGX


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit and Finance Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: ADVANCED MICRO DEVICES INC

ticker: AMD


text: The Information Security Department conducts cyber incident tabletop exercises on an ongoing basis. These exercises vary by topic, but may include internal incident response teams, executive management, and third parties that provide services across forensic, legal, and public relations capabilities. The purpose of these tabletops is to simulate a cyber event and work through the event using our Incident Response Plan. This allows our incident response team to become familiar with the logistics of the plan, as well as provide feedback to improve the process and plan. External subject matter experts, such as Bank legal counsel, forensic advisors, marketing agency and insurance broker participate in these exercises.

companyName: FIRST MERCHANTS CORP

ticker: FRME


text: Further, we use third-party service providers to perform a variety of functions throughout our business, such as software-as-a-service providers, data hosting companies, contract research organizations, and contract manufacturing organizations. We have certain vendor management processes designed to help manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management processes may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including, for example, security questionnaires and the imposition of contractual obligations related to cybersecurity on the provider.

companyName: HOOKIPA Pharma Inc.

ticker: HOOK


text: We have experienced targeted cybersecurity threats and incidents in the past that have resulted in unauthorized persons gaining access to certain of our information systems, and we could in the future experience similar incidents. To date, no cybersecurity incident, or any risk from cybersecurity threats has materially affected or has been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned "Operating Risks – Disruptions, failures or security breaches of our information technology infrastructure could interfere with our operations, compromise client information and expose us to liability, possibly causing our business and reputation to suffer" within Part I, Item 1A "Risk Factors".

companyName: CUMULUS MEDIA INC

ticker: CMLS


text: Roles and Responsibilities Peoples' Board of Directors provides oversight of risks from cybersecurity threats primarily through the Risk Committee of the Board. The Risk Committee is comprised of all of the independent directors of the Board, along with Peoples' Chief Executive Officer ("CEO"), and is responsible for oversight of Peoples' risk management policies, programs and processes. The Risk Committee is organized and conducts its business pursuant to a written charter adopted by the Board. At least annually, the Risk Committee reviews and reassesses the adequacy of its charter and recommends any proposed changes to the full Board as necessary to reflect changes in regulatory requirements, authoritative guidance and evolving practices. The Risk Committee provides a report to the entire Board at each meeting of the Board of Directors regarding the overall risk condition of the firm and whether Peoples risk remain within its stated risk appetite.

companyName: PEOPLES BANCORP INC

ticker: PEBO


text: We have not identified risks from known cybersecurity threats that we believe have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, operating results, or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our operations, business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section titled "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Shockwave Medical, Inc.


text: Our cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through cybersecurity threat intelligence, as well as outside audits and certifications. • Incident Response and Recovery Planning: We are establishing incident response, business continuity, and disaster recovery plans designed to address our response to a cybersecurity incident. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. • Periodic Assessments: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are evaluated by management and reported to our Audit Committee and our board of directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: SOLENO THERAPEUTICS INC

ticker: SLNO


text: We have received, and continue to pursue, reimbursements from insurance carriers for costs incurred as a result of the Data Incident. Based on our assessment, the incident has not had a material impact, and we do not believe the incident has materially affected or will materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: As of the date of this report, we are not aware of any recent cybersecurity attacks that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.

companyName: GameStop Corp.

ticker: GME


text: Operational staff members actively maintain, review, update, and exercise plans and procedures designed to enhance our overall business resiliency. Incident Response team members are trained annually on current information and cybersecurity trends, techniques, and their responsibilities to keep our information confidential, accurate, and available.

companyName: QUAINT OAK BANCORP, INC.

ticker: QNTO


text: As previously discussed in Item 1A of this Form 10-K "Risk Factors", failure to maintain the security of the data we are required to protect could have a material adverse effect on our operations and financial results. We currently do not believe that any current cybersecurity threats have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial condition.

companyName: NVR INC

ticker: NVR


text: We continue to evaluate and enhance our systems, controls, and processes where possible, including in response to actual or perceived threats specific to us or experienced by other companies.

companyName: NORTHERN MINERALS & EXPLORATION LTD.

ticker: NMEX


text: The CIO and CISO are responsible for the maintenance of the incident response program that is designed to protect our information systems and information from cybersecurity threats and oversee the incident response team which responds to any cybersecurity threats or incidents in accordance with our cybersecurity incident response plan. The cybersecurity incident response team is responsible for monitoring, preventing, detecting, mitigating and remediating cybersecurity threats and incidents and reports such threats and incidents to the CISO (or other relevant stakeholders). Depending on the threat or incident level, the CISO will engage the cybersecurity crisis management team and the cyber incident disclosure committee to determine proper escalation with significant incidents being reported to the Audit Committee.

companyName: HERC HOLDINGS INC

ticker: HRI


text: Our Board of Directors has delegated certain responsibilities to the Audit Committee of the Board. The Audit Committee reviews and discusses with management the identification and mitigation of cybersecurity risks, including (among other things) the effectiveness of risk-management policies and practices designed to help safeguard our operations, financial systems, and data. Our Chief Information and Digital Officer (CIDO) and his executive team, including the Vice President of Information Security and Chief Information Security Officer (CISO), present cybersecurity-related topics, including program maturity progress, regularly to the Audit Committee. The Internal Audit team, in its periodic compliance and risk assessment updates to the Audit Committee, also reports on its reviews of certain of our cybersecurity risk exposures, controls, and management actions. The full Board also receives cybersecurity evaluations from time to time.

companyName: COSTCO WHOLESALE CORP /NEW

ticker: COST


text: We continuously evaluate and seek to improve and mature our cybersecurity processes against government standards. Our cybersecurity program is regularly assessed through management self-evaluation and ongoing monitoring procedures to evaluate our program effectiveness, including assessments associated with internal controls over financial reporting as well as vulnerability management through active discovery and testing to validate patching and configuration. As cybersecurity threats are continuously evolving, we also periodically engage with third parties to perform maturity assessments of our program to identify potential risk areas and improvement opportunities. This includes assessment of our overall program, policies and processes, compliance with regulatory requirements and an overall assessment of key vulnerabilities. We use these assessments to supplement our own evaluation of the overall health of our program and target improvement areas.

companyName: PRECISION OPTICS CORPORATION, INC.

ticker: POCI


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, standards, processes, and practices, which are integrated into our overall risk management system. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, protect against, detect, respond to, and recover from security incidents. These efforts are implemented by our Global Technology & Solutions ("GTS") team in partnership with our business, legal, and compliance teams, and are essential for us to conduct investment activities, manage internal administration activities, and connect our global enterprise.

companyName: Carlyle Group Inc.

ticker: CG


text: The Company's Senior Director, Information Security & Network Systems, in coordination with the Senior Vice President, Information Technology, is responsible for leading the assessment and management of cybersecurity risks. The Senior Director, Information Security & Network Systems and Senior Vice President, Information Technology regularly review and assess cybersecurity initiatives and are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through briefings with internal and external personnel as well as alerts from security measures deployed in the Company's IT environment. These individuals collectively have over 30 years of experience in information security. The Senior Vice President, Information Technology reports to the Board, the Audit Committee and management on cybersecurity risk assessment, policies, incident prevention, detection, mitigation, and remediation of cybersecurity incidents on an as needed basis.

companyName: SL GREEN REALTY CORP

ticker: SLG


text: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. To mitigate the threat to our business and address regulatory requirements, we take a comprehensive approach to cybersecurity risk management and have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. We devote significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure.

companyName: UNITED BANCORP INC /OH/

ticker: UBCP


text: We maintain a Cybersecurity Incident Response Plan (CIRP) to assist in promptly responding to, resolving, and recovering from cybersecurity incidents. The CIRP includes guidelines for assessing, identifying, managing, reporting, including disclosure of material breaches with the SEC, and remediating cybersecurity incidents. Following a cybersecurity incident, external subject matter experts, including legal counsel are consulted to reduce the risk of further compromise to our information and to ensure proper reporting and documentation. The Audit Committee would be informed promptly of material cybersecurity incidents in the event that they arise. If a material cybersecurity incident were to occur, it could have a material effect on our business strategy, results of operations and financial condition. For more information see Item 1A. "Risk Factors" for the Risk Factor entitled "Our operations depend on the proper functioning of information systems, and our business or results of operations could be adversely affected if we experience a cyberattack or other systems breach or failure."

companyName: ACCENDRA HEALTH INC/VA/

ticker: ACH


text: The Board is responsible for overseeing our risk management governance, and our Board, together with its committees, engages with our management team in monitoring Company risks, including cybersecurity and data protection risks. The Audit Committee is responsible for risk oversight, including risks related to cybersecurity threats, and periodically reviews our information security programs, including our cybersecurity efforts.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: Our cybersecurity program incorporates ongoing risk management practices such as risk identification and the maintenance of a cyber risk register, threat intelligence tracking, identification and monitoring of key controls using key performance indicators, the performance of independent control effectiveness testing by internal audit, annual third-party risk assessments, external penetration testing, and cyber incident response exercises. Our cybersecurity program also incorporates processes intended to help anticipate emerging technology innovation, utilizing a security capability map as a resource in combination with our cyber risk and enterprise risk assessment processes, to inform and prioritize investment decision-making in connection with the cybersecurity program. Additionally, we collaborate with industry associations, government authorities, peers and external advisors to monitor the threat environment and to inform our security practices, including for industry best practices for cybersecurity programs and capabilities, incident response processes, legal and regulatory developments, and experiential guidance. Our cybersecurity risk management activities are integrated in our overall enterprise risk management processes, so that cyber risks are assessed in the context of other risks relevant to our overall enterprise risk profile, to inform the organization's decision-making and planning.

companyName: HANOVER INSURANCE GROUP, INC.

ticker: THG


text: Our cybersecurity team meets frequently to monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. In the event of a cybersecurity incident, we have an incident response plan that governs our immediate response including detection, escalation, assessment, management and remediation. As part of incident response, the cybersecurity team will also coordinate with external advisors and other key stakeholders as needed. The cybersecurity team routinely tests this plan across the organization to validate the procedures for appropriately escalating potentially material cybersecurity risks and incidents. Also, we provide an annual, mandatory cybersecurity training program for employees that is intended to help them understand cybersecurity risks and comply with our cybersecurity policies.

companyName: NIKE, Inc.

ticker: NKE


text: We have implemented best-practices to assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program (see section "Services Overview" for details on each service we use). To protect our information systems from cybersecurity threats, we rely on various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. We have chosen Microsoft as our main provider for Cybersecurity and Governance services. Our Technology Risk Management Committee, currently including our Vice President of Information Technology, In-house General Counsel, General Manager, Director of Operations and Vice President of Technical Operations, assesses risks based on probability and potential impact to key business systems and processes. Risks that are considered high are addressed promptly and documented to be incorporated into our overall risk management program. A mitigation plan is developed for each identified high risk, with progress reported to the Technology Risk Management Committee and tracked as part of our overall risk management program overseen by the Audit Committee of our board of directors.

companyName: RYTHM, Inc.

ticker: RYM


text: The structure of the Company's information security program is designed around the National Institute of Standards and Technology Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, the Company leverages certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. The Chief Information Security Officer (CISO), who reports directly to the Chief Risk Officer, and the Chief Information Officer (CIO), who reports directly to the Director of Corporate Strategy, along with key members of their teams, regularly collaborate with peer banks and industry groups to discuss cybersecurity trends, issues and best practices. The information security program is periodically reviewed with the goal of addressing changing threats and conditions.

companyName: PROSPERITY BANCSHARES INC

ticker: PB


text: Due to the importance of cybersecurity to the Company, the full Board is charged with oversight responsibility for our risk management and security strategy and policy. The Board is composed of members with diverse expertise including, risk management, information technology, engineering, manufacturing, innovation and finance, equipping them to oversee cybersecurity risks effectively. The Board receives updates from the CISO and management at its quarterly board meeting, which updates cover the Company's cybersecurity strategy, current cybersecurity risk assessment, key risk areas, current cyber trends, and any significant cyber incidents that have occurred or are reasonably likely to occur.

companyName: Allegion plc

ticker: ALLE


text: We engage with external resources to contribute to and provide independent evaluation of our cybersecurity practices, including a periodical assessment of our cybersecurity program performed by a third party. Our cybersecurity leadership and operational teams monitor cybersecurity threat intelligence and applicable cybersecurity regulatory requirements in a variety of ways, including by communicating with federal agencies, trade associations, service providers, and other miscellaneous third-party resources. Our management team through consultation with our Senior Vice President and Chief Digital Officer ("CDO"), Vice President and Chief Information Security Officer ("CISO") and the Audit Committee of our Board use the information gathered from these sources to inform long-term cybersecurity investments and strategies which seek to identify, protect, detect, respond and recover from cybersecurity incidents.

companyName: Marathon Petroleum Corp

ticker: MPC


text: Under the oversight of the Enterprise Risk Committee, relevant information regarding the Company's cybersecurity profile and any cybersecurity threats or incidents is then communicated during the regular updates to the Audit Committee in a process designed to ensure the Board of Directors and Audit Committee maintains appropriate oversight of the Company's cybersecurity strategy and risk profile.

companyName: DOMINOS PIZZA INC

ticker: DPZ


text: Security Awareness and Education The Bank provides annual, mandatory on-site training for personnel regarding security awareness to equip personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Bank's information security policies, standards, processes, and practices. Staff IT training process is monitored, tracked and reported to the IT Committee and Board of Directors. We have also employed a program of staff phishing tests with staff response evaluated and reported to the IT Committee and the Board of Directors. Incident Response Program (IRP)

companyName: River Financial Corp

ticker: RVRF


text: We strive to create a culture of cybersecurity resilience and awareness and believe that cybersecurity is the responsibility of every employee and contractor. At the same time, primary responsibility for assessing, monitoring, and managing our cybersecurity risks lies with our Director of Information Technology.

companyName: CYPHERPUNK TECHNOLOGIES INC.

ticker: CYPH


text: The Company's Chief Information Security Officer has served in various roles in information technology and information security for over 25 years, including serving as Vice President of Information Security and Product Security Officer for large public companies. In addition, the Company's Chief Information Security Officer has previously held roles including Security Risk Assessor, Security Policy Development, and Security Architect. The Company's Chief Information Security Officer has also contributed to the development and review of various security-related publications including the National Institute of Standards and Technology, the International Organization for Standardization, and the Cloud Security Alliance, has served in numerous roles on various cybersecurity-related advisory boards, and holds a B.S. in Electrical Engineering from Fairleigh Dickinson University.

companyName: PENN Entertainment, Inc.

ticker: PENN


text: We also maintain third party security procedures to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: Stereotaxis, Inc.

ticker: STXS


text: The Technology Committee is briefed at least quarterly, on the quality and effectiveness of our cybersecurity practices and policies, information security program and infrastructure, and data governance and security program, along with key initiatives in this area. The Technology Committee also assesses the cybersecurity risk management strategy. This assessment includes reviews of the results of audits, testing, and metrics, including reports of third-party reviewers.

companyName: MAXIMUS, INC.

ticker: MMS


text: Our Chief Information Officer has over 20 years of experience in overseeing cybersecurity and risk management. In addition, our Chief Legal and Administrative Officer has over 25 years of risk management experience and our Chief Financial and Operations Officer has over 20 years of experience in overseeing risk management and cybersecurity. This team is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes experience running cybersecurity programs at similarly situated commercial biotechnology organizations and navigating the associated risk landscape.

companyName: ARDELYX, INC.

ticker: ARDX


text: Our management team actively evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs. To date, our operations or financial standing have not been materially impaired by any cybersecurity challenges. Looking ahead, the Company will mandate comprehensive cybersecurity training for both the Board and employees, covering key areas such as physical security of assets, data privacy and other information security policies and procedures.

companyName: CoJax Oil & Gas Corp

ticker: CJAX


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company to date, including our business strategy, results of operations or financial condition.

companyName: GAIA, INC

ticker: GAIA


text: Like many other companies, the Company relies on third-party vendor solutions to support its operations; many of these vendors have access to sensitive and proprietary information. Third-party vendors continue to be a notable source of operational and informational risk. Accordingly, the Company has implemented a Third-Party Risk Management program, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive company data.

companyName: OCEANFIRST FINANCIAL CORP

ticker: OCFC


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a security incident response plan.

companyName: Seres Therapeutics, Inc.

ticker: MCRB


text: Network and information systems and other technologies play an important role in our business activities. We also obtain certain confidential, proprietary and personal information about our charterers, personnel, and vendors. To protect our data, we have employed cybersecurity protocols which are designed to work in tandem with internal controls to safeguard our information technology environment. Our information technology infrastructure is designed with commercial flexibility, data integrity, and safety in mind. We utilize a layered approach of systems and policies intended to provide a secure operating environment and promote business continuity. Our hardware and software systems are equipped with technology intended to offer access and intrusion protection, software and communications systems protections, and mitigate cybersecurity threats.

companyName: GENCO SHIPPING & TRADING LTD

ticker: GNK


text: We have adopted cybersecurity control principles based on the National Institute of Standards and Technology Cybersecurity Framework (NIST), the Center for Internet Security (CIS) and ISO 27001. Further, our cybersecurity controls are designed to comply with applicable laws concerning protection of private information, including the EU General Data Protection Regulation (GDPR), Brazil's Lei General de Prote o de Dados Pessoais (LGPD) and the California Consumer Privacy Act of 2018 (CCPA).

companyName: IPG PHOTONICS CORP

ticker: IPGP


text: Our Board of Directors has ultimate oversight of cybersecurity risk and our CISO provides periodic reports and updates concerning our cybersecurity program to the Board, as well as our Chief Executive Officer and other members of our senior management, as appropriate. Cybersecurity reports to the Board generally occur at least annually, with updates as deemed necessary by our CISO or, senior management. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information network and data security, assessments of the information security program, and the emerging threat landscape.

companyName: Trinseo PLC

ticker: TSEOF


text: Prevention and Preparation We employ a variety of measures to prevent threats related to privacy, information technology security and cybersecurity, which include password protection, frequent mandatory password change events, multi-factor authentication, internal phishing testing, vulnerability scanning and penetration testing.

companyName: W. P. Carey Inc.

ticker: WPC


text: The Company has adopted an Incident Response Plan (the "Plan") to monitor, detect, mitigate and remediate cybersecurity incidents. The Plan requires all employees to have a working knowledge of the Company's Information Security Program and Incident Response Policies. Pursuant to the Plan, the Information Technology Administrator and Senior\Compliance Management identify information owners for sensitive customer information and create an incident response team. Each Department Manager, upon notification of a potential unauthorized access, manipulation of data or theft of any item identified under GLBA Inventory and Asset Classification, is responsible for further assessing the situation in order to document the suspected or actual breech, and forward the appropriate documentation to the Information Technology Administrator. The documentation of the suspected or actual incident includes the following: a. Identify the nature and scope of the incident. b. Identify the information systems affected. c. Identify the types of customer information potentially affected.

companyName: PARKE BANCORP, INC.

ticker: PKBK


text: Cybersecurity awareness among our employees is promoted with regular training and awareness programs. All employees who have access to our systems are required to undergo cybersecurity training at least annually and, under the shared services cybersecurity program, our employees will be required to review and acknowledge our cybersecurity policies each year. User access controls have been implemented to limit unauthorized access to sensitive information and critical systems. Employees are required to use multifactor authentication and keep their passwords confidential, among other measures.

companyName: USA Compression Partners, LP

ticker: USAC


text: We maintain a comprehensive cybersecurity risk management program that aligns to the National Institute of Standards and Technology (NIST) Cyber Security Framework and adopts a variety of cybersecurity best practices across the enterprise. We leverage industry-leading cybersecurity vendors that provide the following capabilities: Managed Detection and Response (MDR); a Security Operations Center (SOC) that monitors the Company's IT assets on a 24x7x365 basis; tools to interdict emails with phishing links and malware payloads; data leak protection tools that provide real-time interdiction of data transfers outside of normal business usage; vulnerability detection and automated patching tools; firewalls and instruction detection systems; multi-factor authentication mechanisms; mobile device management systems; penetration testing; and various third -party assessments. Our critical IP data is maintained on segmented, access-controlled data stores. We utilize a variety of backup mechanisms for its data including both warm and cold storage solutions. Lastly, we utilize token-based technologies to support Payment Card Industry Data Security Standard (PCI DSS) compliance safe handling and protection of credit card data.

companyName: GEOSPACE TECHNOLOGIES CORP

ticker: GEOS


text: Periodically, at least annually, ORIX USA's CIO and/or other members of the ORIX USA information and cybersecurity team will present to the LFT audit committee on various topics relating to ORIX USA's technology risks, including ORIX USA's cybersecurity program (including the results of cybersecurity tabletop exercises), cybersecurity issues (including those relating to data protection, insider threats, regulatory changes and geopolitical cyber threat management) and risk management (including the results of periodic technology audits).

companyName: Lument Finance Trust, Inc.

ticker: LFT


text: Board of Directors' Oversight of Risks from Cybersecurity Threats The Nominating and Governance Committee oversees our GRC Program per its charter, reviewing and considering developments related to the GRC Program and reporting on the GRC Program's activities and recommendations to the full Board.

companyName: EQUINIX INC

ticker: EQIX


text: Our systems are regularly targeted by attacks aimed at disrupting services, misusing or accessing customer data without authorization, seeking financial extortion, or executing fraudulent activities. To date, no such incidents have significantly impacted the Company's operations or adversely affected our customers, nor have they materially influenced our operational results. Nevertheless, it is important to acknowledge that we cannot guarantee the prevention or detection of sophisticated cyber-attacks. In the event of significant service disruptions, unauthorized access leading to the misuse of customer information, or fraudulent activities affecting our or third-party systems, the Company may face operational, regulatory, legal, and reputational challenges, which could adversely affect our business and financial conditions.

companyName: CENTRAL PACIFIC FINANCIAL CORP

ticker: CPF


text: Additional information regarding the Company's risk management framework, including management-level and Board-level committee experience and expertise, oversight responsibilities, and information risk governance, can be found under the section captioned "Risk Management Framework" contained in Item 1. Business.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: Our cybersecurity risk management program leverages a combination of processes, technologies and personnel with expertise in cybersecurity to comply with applicable regulations and detect and respond to cyber-attacks, data breaches, security incidents, and compromises of personal information, as well as to regularly and promptly inform management and our Board of Directors of any significant cybersecurity risks and developments.

companyName: UNIVERSAL BIOSENSORS INC


text: Our Program is integrated into our Enterprise Risk Management (ERM) program and includes a vendor risk management program supported by our security and compliance teams. We assess vendor cybersecurity risks according to HIPAA and NIST CSF standards and have established an oversight process to manage cybersecurity risks related to the products and services we procure.

companyName: InnovAge Holding Corp.

ticker: INNV


text: In the event of a cybersecurity incident, the CSIRT has an Incident Response Plan that outlines the steps that are designed to help ensure regulatory requirements are met and cyber vulnerabilities, if any, are addressed. We periodically conduct "tabletop" exercises to simulate cybersecurity incidents and help ensure that we are prepared to respond to such incidents in accordance with our internal policies and programs, as well as applicable laws and regulations. In addition, tabletop exercises allow us to identify areas for potential improvement and maturation of our Incident Response Plan, or other aspects of our cybersecurity risk management program. These exercises have included participation by members of our Cybersecurity Disclosure Committee, including our CAO and Chief Financial Officer.

companyName: TRIUMPH GROUP INC


text: We also engage external experts to evaluate our cybersecurity programs. These evaluations include regular audits, threat assessments, simulated attacks, vulnerability scans and advice on information security practices. We routinely conduct incident response exercises with key stakeholders.

companyName: MATRIX SERVICE CO

ticker: MTRX


text: Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually.

companyName: NORTECH SYSTEMS INC

ticker: NSYS


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization Standardization ("ISO") 27001 Information Security Management System Requirements. SLB has an annual assessment, performed by a third party, of the Company's cyber risk management program against the NIST CSF.

companyName: SLB LIMITED/NV

ticker: SLB


text: In an attempt to manage and mitigate material risks from cybersecurity threats, the Company's cybersecurity risk management process includes certain preventive measures, detective controls, and incident response procedures, depending on the environment and systems. This includes implementing security controls in certain environments and systems, ongoing monitoring of certain environments and systems, adopting response protocols for security incidents, and maintaining cybersecurity insurance. The Company's cybersecurity risk management approach is periodically reviewed by management and certain external service professionals to assess whether any changes are needed to reflect changing threats.

companyName: Willdan Group, Inc.

ticker: WLDN


text: We believe that the processes, policies and procedures established by the Committee and the Subcommittee provide guidance for consistent and effective incident handling and response and set standards for internal notifications and escalations, as well as external notification considerations with respect to a cybersecurity event or incident requiring disclosure or notification in accordance with applicable laws.

companyName: Creative Media & Community Trust Corp

ticker: CMCT


text: For additional information, see "Item 1A—Risk Factors." In the last reporting year, we did not experience any material cybersecurity incidents or threats.

companyName: Grace Therapeutics, Inc.

ticker: GRCE


text: Our information security team in combination with other third-party vendors monitor our information systems for suspicious activity, such as unauthorized intrusions. Suspected or confirmed threats, incidents, or events, however, also may be reported by bank employees, customers, intrusion detection systems, third-party servicers, or government entities. Once reported, cybersecurity incidents are to be brought to the attention of our Information Technology and Security Team. Depending upon the nature and perceived threat level of the reported event, our overall enterprise risk management process would require the involvement of other management and response teams representing other groups (e.g., Information Technology, Information Security, Legal/Compliance, Corporate Security, Internal Audit, Human Resources, Finance/Accounting, Corporate Communications, Designated Cyber Coach) within our organization.

companyName: UNITED COMMUNITY BANKS INC

ticker: UCB


text: As a leading cybersecurity provider, we understand the importance of robust cybersecurity practices, and safeguarding and certifying our solutions to internationally recognized commercial and government standards. Trust is the foundation of everything we do, and we earn that trust through a comprehensive approach to identifying, managing and mitigating cybersecurity risk to our business and operations.

companyName: Zscaler, Inc.

ticker: ZS


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors has been responsible for monitoring and assessing our strategic risk exposure with respect to cybersecurity risks and, going forward, the audit committee of our board of directors will oversee management of such risks. Our executive officers, including our CEO and CFO, are responsible for day-to-day management of the material risks we face.

companyName: Identiv, Inc.

ticker: INVE


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Senior Vice President of IP and Contracts and other members of the management team. Our team has over ten years in information technology, cybersecurity, risk management, and compliance and includes individuals with BS degrees in Information Technology and several information technology and security certifications.

companyName: BioAtla, Inc.

ticker: BCAB


text: The readiness of the incident response team is promoted through table-top exercises and threat simulations, including during the fiscal year ended February 28, 2025. The Company also conducts mandatory training of all employees on its security and data privacy practices and policies and periodically sends simulated phishing emails to employees to build resilience.

companyName: BLACKBERRY Ltd

ticker: BB


text: A primary element of our cybersecurity program is the implementation of controls that are aligned with industry guidelines and applicable regulations to identify threats, deter attacks, and protect our information security assets. We do not engage third parties in connection with our cybersecurity program.

companyName: SOLIGENIX, INC.

ticker: SNGX


text: As of the date of this Annual Report on Form 10-K, the Company has not identified any cybersecurity incidents materially affecting its business strategy, results of operations, or financial condition. Recognizing cybersecurity threats continue to evolve, the Company maintains a focus on enhancing its detection, response, and resilience capabilities. The Company cannot assure the prevention of future cybersecurity incidents.

companyName: CHAIN BRIDGE BANCORP INC

ticker: CBNA


text: We also require all employees to complete cybersecurity awareness training annually, and we circulate cybersecurity awareness alerts, safety tips and newsletters to employees across the enterprise regularly. In addition, we routinely run phishing campaigns and perform other tests to increase awareness of cybersecurity threats.

companyName: Ardent Health, Inc.

ticker: ARDT


text: Our Chief Technology Officer, Chief Legal Officer and Head of Cybersecurity provide the Audit and Risk Committee with no less than quarterly updates on the status of the Cybersecurity Program, information systems and any material security incidents, or more frequently if circumstances warrant, including on topics related to information security, data privacy and cyber risks and mitigation strategies.

companyName: Oportun Financial Corp

ticker: OPRT


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program. The Board of Directors receives periodic reports from management on our cybersecurity risks and management updates the Board of Directors, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Board of Directors also receives briefings from management on our cybersecurity risk management program and presentations on cybersecurity topics from external experts as part of the Board of Directors' continuing education on topics that impact public companies.

companyName: AQUABOUNTY TECHNOLOGIES INC

ticker: AQB


text: Consistent with our overall risk management governance structure, the Vice President of IT Security is responsible for the day-to-day management of cybersecurity risk, while our Board and its Audit Committee play an active, ongoing oversight role.

companyName: SEMTECH CORP

ticker: SMTC