text: When a cybersecurity incident occurs, the Company establishes a cross-functional incident response team to respond to the specific cybersecurity incident. The incident response team consists of a subset of members from the standing crisis response team, including personnel with the most relevant experience related to the specific incident. This collaborative approach is intended to enable the Company to leverage expertise throughout the business to address cybersecurity events and to evaluate the potential financial, legal, operational and reputational implications of an incident, or series of related incidents. In considering the materiality of an event, related attacks, whether in terms of quantity or impact, are reviewed individually and in the aggregate to determine whether they may have a significant impact on the Company's financial condition, results of operations or business strategy, either quantitatively or qualitatively.

companyName: American Water Works Company, Inc.

ticker: AWK


text: Brunswick's leadership recognizes the importance of information security and managing cybersecurity risks across the enterprise. We manage our global business operations through a variety of systems for commercial transactions, customer interactions, manufacturing, branding, employee tracking, and other applications. Systems based on legacy technology, sometimes added through acquisitions or hosted by third parties, and/or that contain personal information of customers or employees, present risks of erroneous or fraudulent transactions, disclosure of personal, sensitive, and confidential information, loss of reputation and confidence, potential impacts on our operations, and may result in legal claims or proceedings, penalties, and remediation costs.

companyName: BRUNSWICK CORP

ticker: BC

secItem: Item 1C


text: In addition, management has worked, and expects to continue to work, with third-party service providers, as appropriate, to assess, identify and manage cybersecurity risks. Management also conducts periodic and on-demand assessments of our cybersecurity risk management program with expert service providers to ensure it complies with and meets current ISO 27001 standards. In early 2024, our management team performed an exercise tabletop relating to potential cybersecurity risks.

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA


text: We have a dedicated team of information security professionals (our "information security team") who lead our enterprise-wide cybersecurity strategy, which includes risk management, cyber defense, systems security, security monitoring and other related functions. This team is overseen by our Senior Director of Information Security ("SDIS") who reports to our Chief Information Officer ("CIO"). The SDIS has over 25 years of experience in the field of cybersecurity and is responsible for our overall business resilience and information security strategy, security engineering and operations, cyber threat detection and response, and policy recommendations. In addition, our SDIS has a significant background in general information technology and program management. Our information security team manages our robust enterprise security structure, which is designed to prevent cybersecurity incidents, while simultaneously increasing our technology resilience to minimize the associated business impact of cybersecurity threats. Core to our information security team's structure is our security incident response team, which is responsible for the protection, detection and overall response capabilities in defense of our corporate resources and assets. Furthermore, we believe strongly in a supportive and collaborative culture of security, whereby all our employees maintain a role in our corporate cybersecurity posture, including but not limited to their participation in periodic training and risk management exercises throughout the year.

companyName: EPLUS INC

ticker: PLUS


text: Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our information security team, internal governance processes, and by reviewing the results of internal and third-party assessments and audits. Our CISO regularly reports directly to the audit committee on our cybersecurity program and our efforts to prevent, detect, mitigate, and remediate cybersecurity risks. In addition, we have a Security Governance Council, made up of members of our senior management team as well as relevant security personnel, that meets periodically to discuss and address relevant cybersecurity matters.

companyName: Genpact LTD

ticker: G


text: We incorporate industry best practices throughout our cybersecurity program to the extent practicable for a company of our size and resources. New leadership is committed to improving our cybersecurity strategy, with the goal of enhancing controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program will be aligned with applicable industry standards and maintained by a third-party technology firm. The third-party firm has processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things, annual and ongoing security awareness advice for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools.

companyName: BION ENVIRONMENTAL TECHNOLOGIES INC

ticker: BNET


text: Management is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology and/or compliance personnel of FS/EIG Advisor and FS Investments.

companyName: FS Specialty Lending Fund

ticker: FSEN


text: Superior employs a risk-based vulnerability management process for assessing and managing cybersecurity risk. Utilizing the National Institute of Standards and Technology ("NIST") cybersecurity framework, the IT team assesses the risk based on the Center for Internet Security Critical Security Controls. The assessment includes the ability to identify, protect, detect, respond and recover from cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers. The risk-based vulnerability management prioritizes action under both an asset context and vulnerability context, considering factors such as asset exposure, potential business effect, threat context, and vulnerability severity.

companyName: SUPERIOR INDUSTRIES INTERNATIONAL INC

ticker: SSUP


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: IN8BIO, INC.

ticker: INAB


text: Collaborative Approach: The Company has adopted a cross-functional approach toward identifying, prioritizing, and implementing the means to protect information technology systems and its employees from cybersecurity threats. Additionally, the Company has established communications protocols and processes to escalate cybersecurity incidents to engage management as needed to make timely decisions regarding incident response, recovery, and any required disclosures.

companyName: FUELCELL ENERGY INC

ticker: FCEL


text: The General Partner has no t identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the General Partner or the Partnership's business strategy, results of operation or financial condition. Nonetheless, there is no guarantee that a future cyber incident would not materially affect the General Partner or the Partnership's business strategy, results of operations or financial condition. Despite the various efforts the General Partner has undertaken to mitigate cyber risks and their impact, systems, networks and/or devices potentially can be breached. Such cybersecurity breaches may cause: (i) disruptions and impacts to business operations, potentially resulting in financial losses to the Partnership and limited partners; (ii) interference with the General Partner's ability to calculate the value of an investment; (iii) impediments to trading; (iv) the inability of the Partnership and its service providers to transact business; (v) violations of applicable privacy and other laws; (vi) regulatory fines, penalties, reputational damage, reimbursement or other compensation costs or additional compliance costs; and (vii) the inadvertent release of confidential information. Similar adverse consequences could result from cybersecurity breaches affecting counterparties with which the Partnership engages in transactions; governmental and other regulatory authorities; exchange and other financial market operators, banks, brokers, dealers, insurance companies and other financial institutions; and other parties. In addition, substantial costs may be incurred by these entities in order to prevent any cybersecurity breaches in the future. The nature of malicious cyber-attacks is becoming increasingly sophisticated and the Partnership cannot control the cyber systems and cybersecurity systems of counterparties or third party service providers. While, to date, we have not been subject to cyberattacks that, individually or in the aggregate, have been material to our operations or financial condition, the preventive actions we take to reduce the risks associated with cyberattacks may be insufficient to repel or mitigate the effects of a major cyberattack in the future.

companyName: Millburn Multi-Markets Fund L.P.


text: In an effort to help deter and detect cyber threats, we regularly provide all employees, including part-time and temporary employees, with data protection cybersecurity and incident prevention training throughout the year, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Carisma Therapeutics Inc.

ticker: CARM


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have material ly affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Our Business Operations and Industry—If our information technology systems are breached or there is otherwise unauthorized disclosure of or access to customer data, our data, or our platform, our platform may be perceived as insecure, we may lose customers or fail to attract new customers, our reputation and brand may be harmed, and we may incur significant liabilities."

companyName: Amplitude, Inc.

ticker: AMPL


text: We engage third-party vendors, assessors, consultants, auditors, and other third party service providers in connection with the above processes. We recognize that third-party service providers introduce cybersecurity risks. We have implemented processes to oversee and identify the risks from cybersecurity threats that impact select suppliers and third-party service providers with whom we share personal identifying and confidential information. The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management processes.

companyName: Select Water Solutions, Inc.

ticker: WTTR


text: Our Board of Directors is actively engaged in overseeing our cybersecurity and information security program. Our Board of Directors receives regular reports during board meetings from our CCO on our and our Adviser's and Administrator's efforts concerning information security and addressing information technology and cybersecurity risks no less than quarterly. The reports are distributed to our Board of Directors, and our CCO engages in detailed discussions with the independent board members during the independent members' session. The reports cover all potentially material cybersecurity threats facing us, as well as key risks and mitigation efforts undertaken by us and our Adviser and Administrator. As significant threats or events are identified by management or the ISP between regular reporting periods, our CCO will inform our Board of Directors immediately and keep it informed as to the developments of assessing the risks, mitigating efforts, and potential disclosure. Appropriate members of management and third-party providers will be involved as deemed necessary based on the potential impact.

companyName: GLADSTONE LAND Corp

ticker: LAND


text: Global cybersecurity vulnerabilities and threats continue to evolve and are increasingly more sophisticated. The Company is aware of the dynamic nature of the cybersecurity threats we face and has a security program led by our Chief Information Security Officer (CISO) that strives to monitor and mitigate risks from cybersecurity threats. The CISO reports to the Chief Information Officer (CIO), provides periodic reports to the Chief Executive Officer (CEO) and Chief Financial Officer (CFO), and reports quarterly to the Audit Committee of the Board of Directors, which oversees risks from cybersecurity threats, regarding the Company's cybersecurity risk profile and mitigation activities. The Company's CISO has over 35 years of security and cybersecurity experience between the military and corporate sectors. Prior to joining Benchmark, he oversaw cybersecurity for Masco Corporation, a Fortune 500 company and La-Z-Boy Incorporated, both of which are global manufacturing organizations with similar complexities as the Company. The CISO also served as a member of the Department of Defense as a civilian in charge of cybersecurity for an Army acquisition command, overseeing the cybersecurity for approximately 320 programs of record.

companyName: BENCHMARK ELECTRONICS INC

ticker: BHE


text: Our IT Security team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes. Team members are afforded opportunities to attend external training, conferences and other events to remain on top of most recent cybersecurity trends. Our team is led by our Director of IT Infrastructure and Security, who brings over 30 years of experience, which includes implementing and verifying the effectiveness of cybersecurity controls in a Defense Industrial Base environment and defining and executing cybersecurity strategy to enable business delivery while simultaneously protecting intellectual property and privacy. Our Director maintains the following internationally recognized certifications: Global Information Assurance Certification ("GIAC") Security Essentials, GIAC Certified Enterprise Defender, GIAC Certified Incident Handler Certification, GIAC Certified Windows Security Administrator, and GIAC Critical Controls Certification. Our Director reports to our Vice President of Information Technology, who receives continuous updates regarding the prevention, detection, mitigation and remediation of cybersecurity incidents. Our Vice President of Information Technology has over 19 years of experience in developing and executing strategic initiatives to drive organizational growth and innovation, with responsibilities for IT governance, technology strategy development, and cybersecurity. In additional to a Masters of Business Administration, our Vice President of Information Technology holds a Certified Information Systems Security Professional certification.

companyName: MATRIX SERVICE CO

ticker: MTRX


text: Additionally, we have engaged third party providers to supplement our response capabilities for both informational and operational technology incidents, as needed.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: In conducting its duties, the ISG relies on the experience and expertise of the Investment Adviser's third-party IT service provider, which includes, among other things, over two decades of managing network security for companies, a track record of collaborating with management teams on incident response and threat mitigation, and, through various partnerships, vetting and implementing cutting-edge cybersecurity technologies. The ISG will provide a report, at least annually, to the entire Board regarding our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk mitigation-related goals, the Investment Adviser's incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps the Investment Adviser's management has taken to respond to and mitigate such risks. The Investment Adviser's incident response plan provides guidelines for responding to cyber incidents and facilitates coordination across multiple operational functions of the Investment Adviser. The incident response plan includes notification to the ISG and, depending on its nature, escalation to the Board, if appropriate. The Board is also encouraged to engage with the ISG on cybersecurity topics at other times, and material cybersecurity threats and risks are also considered by the Board in relation to other important matters that come before it.

companyName: SLR Investment Corp.

ticker: SLRC


text: Our and our Manager's Enterprise Risk Management unit separately provides independent oversight and monitoring of the Cybersecurity Program through periodic quality control testing and regulatory compliance verification of the Cybersecurity Program's controls. Our Internal Audit unit is an independent corporate function reporting to the board of trustees' Audit Committee that also reviews the effectiveness of the Cybersecurity Program and whether it is effectively integrated into our and our Manager's overall enterprise risk management framework. Additionally, our and our Manager's Enterprise Risk Management and Internal Audit units may from time to time separately engage consulting services to perform independent cybersecurity controls audits and provide expert guidance.

companyName: PennyMac Mortgage Investment Trust

ticker: PMT


text: We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: Under our information security framework, our Board and our Risk Management Committee are primarily responsible for overseeing and governing the development, implementation, and maintenance of our WISP, with the Board designating our Risk Management Committee to provide oversight and governance of technology and cybersecurity risks. Our Board receives an update on cybersecurity at least twice a year from our CISO or their designee. Our Risk Management Committee receives reports on cybersecurity at least four times a year, with ad hoc updates as needed. In addition, our Risk Management Committee annually approves our WISP program.

companyName: STIFEL FINANCIAL CORP

ticker: SF


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " Our business and operations would suffer in the event of computer system failures, cyber-attacks, or deficiencies in our or third parties' cybersecurity " in our risk factor disclosures in Item 1A of this Annual Report on Form 10-K.

companyName: Journey Medical Corp

ticker: DERM


text: We deploy stringent email filtering that prohibits incoming messages from insecure email systems (i.e., gmail, yahoo, aol, etc.) that are known to carry viruses, spyware, crypto ransom, etc. We perform regular internal and external penetration tests at the hotel property level.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: Management of the Company is responsible for overseeing our enterprise risk management. In that regard, management receives periodic updates, as appropriate (and no less frequently than annually), regarding the Company's cybersecurity risk management processes and the risk trends related to cybersecurity. Our Board of Directors, in coordination with the Audit Committee, shall review and discuss with management the Company's risks related to information security, including cybersecurity.

companyName: Karman Holdings Inc.

ticker: KRMN


text: CTO conducts regular IT and Security risk assessments. This involves employee sit-alongs, inventorying all tech systems and assets, and reviewing existing practices, procedures, and policies. The findings are meticulously cataloged. Action plans are developed and addressed in priority ranked order. These assessments are updated quarterly, addressing new and outstanding risks and remediation plans.

companyName: Earth Science Tech, Inc.

ticker: ETST


text: To help manage our material risks from cybersecurity threats and to help protect against, detect, and prepare to respond to cybersecurity incidents, we conduct periodic training for employees involved in our systems and processes that handle sensitive data. We also conduct on-boarding cybersecurity awareness assessments, cybersecurity training for all employees, and regular phishing email simulations for all employees. In addition, we use technology-based tools to help mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Solid Biosciences Inc.

ticker: SLDB


text: At least quarterly, our board of directors receives an update from management of our cybersecurity threat risk management and strategy processes, covering topics such as data security posture, any results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our board of directors generally receives materials that include a cybersecurity dashboard and/or other materials discussing current and emerging material cybersecurity threat risks and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments, and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Chief Information Security Officer and/or General Counsel and Chief Privacy Officer. Our board of directors also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: As a company managing the use and disclosure of PHI and PII, our Program incorporates annual independent Systems and Organization Control 2 (SOC 2) Type 2 audits that are conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants, which provide an independent third party evaluation of the design and operating effectiveness of our controls. We also annually perform HIPAA Security Rule risk assessments of our administrative, physical and technical safeguards for protecting the confidentiality, integrity and availability of data.

companyName: Veradigm Inc.


text: We have processes to assess, identify and manage risks from cybersecurity threats as a part of our overall risk assessment process. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. We engage certain external advisors to enhance our cybersecurity oversight where necessary.

companyName: AMERICAN REBEL HOLDINGS INC

ticker: AREB


text: The Adviser's cybersecurity program prioritizes detection and analysis of and response to cybersecurity threats, management of security risks and resilience against cyber incidents, including those that may impact the Company. The Adviser's cybersecurity program is aligned to the Center for Internet Security critical controls framework. The Adviser's cybersecurity risk management processes applicable to the Company include technical security controls, policy enforcement mechanisms, monitoring systems, and other tools. Third-party providers are leveraged to assist in assessing, identifying and managing risks from cybersecurity threats applicable to the Company. The assessment of cybersecurity risks, including those which may be applicable to the Company, is integrated into the Adviser's overall risk management program. The Adviser has implemented and continues to implement risk-based controls designed to prevent, detect, and respond to information security threats and the Company relies on such controls.

companyName: HPS Corporate Lending Fund


text: Given the importance of maintaining the security of the Company's systems and information, cybersecurity risks are also reviewed and addressed relative to assessing new products and services and any third party services providers that may be engaged to provide systems and services to the Company. As an essential element of the Company's cybersecurity program, the Company maintains a third party service provider management program that assesses and addresses the risks associated with third parties providing systems, software and programs that access the Company's information. As part of this oversight, the Company's Risk Management, Legal and/or Information Security Departments review higher risk and material contracts with third party service providers, which includes an evaluation of the cybersecurity risks presented, any safeguards, and service organization controls reports provided by the third parties. Initial and continuing due diligence is also conducted on third party service providers to ensure that they are fulfilling their contractual obligations and satisfying the Company's data security requirements.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: In the ordinary course of our business, we use, store, and transmit digitally confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a third-party information technology vendor, which is overseen by our Senior Vice President of Administration, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct vulnerability and data penetration testing, regularly review third party audits of our cloud-based technology vendors and perform ongoing regular risk assessments. We also conduct periodic employee training on cyber and information security, among other topics. In addition, to our third-party information technology vendor, we also consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: ATOSSA THERAPEUTICS, INC.

ticker: ATOS


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. We have made significant investments in processes, and technology to protect Phoenix's connected vehicles, services, confidential business information, and employee and consumer personal data. We have implemented multiple and varied processes and technologies for the avoidance, identification, assessment, mitigation, and remediation of risks from cybersecurity threats and incidents designated to protect against the cybersecurity risk landscape. We are continuously assessing and enhancing our protection, detection, response, and recovery capabilities and regularly engage with the cybersecurity communities, third-party cybersecurity and compliance partners, internal stakeholders, and organizations leading best practices, to support our goals and objectives. At its core, our cybersecurity risk management program integrates multiple teams across the organization, including our operations team, with leadership and oversight by executive management, the Audit Committee of the Board of Directors ("Audit Committee"), and the Board of Directors ("Board").

companyName: PHOENIX MOTOR INC.

ticker: PEVM


text: Our board, Senior Information Officer ("SIO") and management actively assess the Company's cybersecurity and data privacy risk management practices with the goal of being proactive rather than reactive. Our SIO and management regularly review the Company's cybersecurity and data privacy risks, including our policies, controls and procedures for identifying, managing and mitigating such risks.

companyName: Investview, Inc.

ticker: INVU


text: The Company's Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board of Directors is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes and procedures are fully integrated into the Company's information technology practices and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Kontoor Brands, Inc.

ticker: KTB


text: b.immediate escalation to and review by our CISO of certain signals, including evidence of external threat actors, ransomware attacks, data exfiltration, identity compromise or unusual requests from management or certain departments;

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: Risks from cybersecurity threats did not materially affect our results of operations or financial condition during the fiscal twelve months ended December 29, 2024.

companyName: Kenvue Inc.

ticker: KVUE


text: We regularly conduct Incident Response Plan tabletop exercises, including simulations of malware and ransomware attacks. Our IT environment and cybersecurity-related controls are reviewed by our internal audit function and external third parties. We sponsor third-party assessments, including cyber risk reviews and penetration testing, to evaluate our cybersecurity program independently.

companyName: Covista Inc.

ticker: CVSA


text: Board Oversight and Governance Our management is responsible for identifying the various risks facing the Company, formulating risk management policies and procedures, and managing the Company's risk exposures. Our Board of Directors' responsibility is to monitor the Company's risk management processes by informing itself concerning our material risks and evaluating whether management has reasonable controls in place to address the material risks. The Audit Committee of the Board of Directors is responsible for discussing with management the Company's major risk exposures and the steps management has taken to monitor and control such exposures, including the Company's risk assessment and risk management policies. Accordingly, our internal risk management team regularly reports to the Audit Committee on our major risk exposures and the steps management has taken to monitor and control such exposures, including our risk assessment and risk management policies. The Audit Committee, in turn, reports on the matters discussed at the committee level to the full Board of Directors.

companyName: FAIR ISAAC CORP

ticker: FICO


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, information technology and management. Personnel at all levels and departments are made aware of our cybersecurity policies through internal communications, training and annual policy updates, and are requested to promptly report any suspected breach of our information systems to management.

companyName: Peraso Inc.

ticker: PRSO


text: The Company believes oversight of cybersecurity risk is the responsibility of the Audit Committee and the full Board. Accordingly, the Audit Committee and the Board oversee the Company's cybersecurity risk management process. The Board considers the Company's cybersecurity posture and risk exposure with management taking into consideration the Company's operations and the types of data retained on its systems as part of its and the Audit Committee's periodic review of the Company's risk management. The Company's primary business involves investments in Agency MBS, which are securities backed primarily by single-family residential mortgage loans. The Company does not receive personal information on individual mortgage borrowers. The Board reviews the Company's cybersecurity program and risk exposure with management on at least an annual basis and receives periodic reports from management, the information technology team, and the Company's third-party security firm on these matters from time to time. The Board may also conduct additional cybersecurity reviews or receive additional updates or reports as it deems necessary. Messrs. Cauley and Haas work collaboratively to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plan. These members of the Company's management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Board when appropriate. Messrs. Cauley and Haas each hold undergraduate and graduate degrees in their respective fields, and each have approximately 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: BIMINI CAPITAL MANAGEMENT, INC.

ticker: BMNM


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including through periodic ERMWG sub-working group meetings; briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Coinbase Global, Inc.

ticker: COIN


text: The CFO and CEO play a pivotal role in informing the Audit Committee on cybersecurity risks. The CFO regularly informs the CEO of all aspects related to cybersecurity risks and incidents ensuring the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. They provide briefings to the Audit Committee as needed, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards.

companyName: City Office REIT, Inc.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Callaway Golf Co

ticker: CALY


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal information of employees and others ("Information Systems and Data"). We design and assess our program based on the International Standards Organization's (ISO) International standard "ISO 27001: Information security management systems", and "ISO 27002: Code of practice for information security controls". This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the ISO standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business."

companyName: OmniAb, Inc.

ticker: OABIW


text: Marcus O. Pegues is an experienced information technology professional in our information technology department and has served as Director of IT since 2021. He works with the Company's internal information technology department and external partners to monitor and improve our cybersecurity capabilities. Mr. Pegues possesses a proven track record of guiding our organization through strategic technology, risk mitigation, process improvement initiatives, and digital transformations. He also possesses extensive experience in technology and cybersecurity, gained over his career spanning more than 15 years. He earned his Master of Science in Information Technology with Specialization in Project Management from Colorado Technical University and his Bachelor of Science in Business Management with Specialization in Information Technology from Colorado Technical University.

companyName: TEJON RANCH CO

ticker: TRC


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

companyName: Marcus & Millichap, Inc.

ticker: MMI


text: Our systems have experienced directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse, or theft of information. To date these incidents have not had a material impact on our service, systems, or business. For more information on how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, refer to "Cybersecurity breaches of our systems and information technology could adversely impact our ability to operate" section included under Item 1A. Risk Factors included in this Annual Report on Form 10-K.

companyName: NV5 Global, Inc.


text: Our technology systems and infrastructure are also potentially vulnerable to computer viruses, breakdowns or other interruptions caused by fires, natural disasters, losses of power, system malfunctions or other disruptions. IT security breaches by third parties who are able to penetrate our systems without authorization or data privacy breaches by employees or others with authorized access pose the risk that sensitive data may be exposed to unauthorized persons or the public, rendered inaccessible or permanently lost. The increasing use and evolution of technology creates additional opportunities for the intentional or unintentional dissemination or destruction of confidential or proprietary information stored in our systems or portable media or storage devices. We may also experience business interruptions (including, but not limited to, the partial or complete shutdown of one or more of our facilities), thefts of information or reputational damage from industrial or nation-state espionage attacks, ransomware, other malware or other cyber incidents or data breaches, which may compromise our system infrastructure or lead to data breaches, either internally or at our third-party providers or other business partners. Such incidents could compromise our trade secrets or other confidential information and result in such information being disclosed to third parties and becoming less valuable. Additionally, many of our employees continue to work remotely either part-time or full-time, which may increase the risk of data breaches or other types of cyber incidents.

companyName: Sotera Health Co

ticker: SHC


text: Our approach to cybersecurity is integral to its operations, reflecting a commitment to safeguarding its innovative technologies and sensitive data. Through a combination of strategic oversight by the Board of Directors and diligent execution by management, we aim to uphold the highest standards of cybersecurity resilience and integrity.

companyName: Crown Electrokinetics Corp.

ticker: CRKN


text: We use a layered approach designed to mitigate the constantly evolving risks from cybersecurity threats by investing in people, processes, and cybersecurity technologies. Our approach is informed by recognized industry standards and frameworks, and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF, and the Center for Internet Security, or CIS, critical security controls.

companyName: Anika Therapeutics, Inc.

ticker: ANIK


text: Risks from cybersecurity threats have not to date materially affected us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "Our internal computer systems, or those of our collaborators or other contractors or consultants, may fail or suffer security breaches, incidents or compromises, which could result in a disruption of our operations and development efforts" in Item 1A. Risk Factors.

companyName: Intellia Therapeutics, Inc.

ticker: NTLA


text: Role of the Board The Board is responsible for cybersecurity risk oversight and receives periodic updates from management on the Company's cybersecurity program, threats, and defense measures implemented. Additionally, our Chief Technology Officer ("CTO") provides updates to the Board on an as needed basis with respect to cybersecurity risks or any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such cybersecurity incident until it has been remediated.

companyName: Hillman Solutions Corp.

ticker: HLMN


text: To assess, identify and manage material risks from cybersecurity threats and to prevent, detect, mitigate and remediate a cyber security or ransomware incident, the following key processes and programs have been implemented and are performed by the Company's Cyber Security Group, which is overseen by the Chief Information Security Officer: • Implementation of security solutions and standards based on industry best practices to prevent unauthorized access. The Company's cyber program has been modeled after the National Institute of Standards and Technology framework; a widely accepted framework utilized by critical infrastructure industries. • Periodic external assessments, including outside system access testing, are performed. Rigorous auditing of all safeguards is performed on a regular basis. Risk assessments are held to identify and address new and changing risks to protect systems and sensitive data. Identified areas are monitored and improvements are implemented. • Eversource participates in information sharing programs both within and outside the utility industry, including with the U.S. government and industry organizations, to be able to identify and respond to emerging threats. • The Company maintains current incident response and business continuity plans, which are periodically updated and tested. • Network activity is monitored on an ongoing basis. • Anti-phishing and malware tools are utilized and assessed. • Employees are trained to recognize phishing attempts and are periodically tested. Results of phishing testing are benchmarked against other companies both within and outside the utility industry.

companyName: NSTAR ELECTRIC CO

ticker: NSARO


text: We do not believe that there are currently any risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we have been the target of cyberattacks and expect them to continue as cybersecurity threats have been rapidly evolving in sophistication and becoming more prevalent in the industry. We cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident in the past or that we will not experience such an incident in the future. For more information on the risks from cybersecurity threats that we face, refer to Part I, "Item 1A. Risk Factors."

companyName: COCA COLA CO

ticker: KO


text: The Company's CIO, supported by the Director of IT Security and Compliance, manages cybersecurity risk. Our CIO has over 25 years of experience in information technology and seven years of experience with the Company. The Company's enterprise-wide cybersecurity strategy is supported by policies, procedures, security controls and training designed to protect the Company's IT systems, operations and sensitive data. Specifically, our Cyber Incident Response Plan provides a process by which our Company is informed about and monitors the prevention, detection, mitigation and remediation of c ybersecurity incidents and includes engaging the Cybersecurity and Risk Management Committee ("CRMC"). The CRMC is a management committee established to identify, assess and manage material cybersecurity incidents, including the incident recovery process within the Company. Depending on the significance of the incident, the Cyber Incident Response Plan could include engaging affected internal and external parties, escalating the issue to executive management, notifying one or more members of our Audit Committee, maintaining communication with users and notifying law enforcement and government agencies as warranted.

companyName: ADVANCED DRAINAGE SYSTEMS, INC.

ticker: WMS


text: We periodically assess risks from cybersecurity threats and monitor our information systems for potential vulnerabilities. However, to date, due to the small size of our company and the nature of our operations, our reliance on information systems has been limited to standard off-the-shelf software (such as Google, QuickBooks, and Microsoft Office) and standard personal computers used by our employees. As a result, management has not implemented any formal process for assessing, identifying, and managing risks from cybersecurity threats.

companyName: Certiplex Corp


text: We have experienced, and will continue to experience, cyber incidents in the normal course of our business. While our approach to cybersecurity risk management is intended to mitigate the threat of a cyber attack or other data compromising incident, it may not be successful in preventing all attacks which could have a significant adverse impact to our business and reputation. See "Risk Factors" above for additional information on risks related our business, including from risks related to cyber-attacks, compromised information security, and technology disruptions and failures. As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: PAMT CORP

ticker: PAMT


text: Overview of Cybersecurity Risk Management The Company maintains a cybersecurity program that is designed to identify, prevent, detect, respond to, and recover from cybersecurity threats, and protect the confidentiality, integrity, and availability of our information technology, including the information residing on such systems. The Company has a dedicated Chief Information Security Officer ("CISO") with overall responsibility for developing and implementing the global cyber strategy, risk management, and operational initiatives. The Company leverages recognized cybersecurity frameworks to organize, improve, and assess its cybersecurity program and to manage and reduce cybersecurity risk. The global information security team, under the direction of the CISO, develops, implements, and manages cybersecurity-related internal controls and risk processes for the Company, with internal controls consisting of a mix of administrative, technical, and physical controls.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: While to date we are not aware of having experienced any material cybersecurity threats or incidents, and we do not believe that risks from such threats or incidents are reasonably likely to materially affect us, our business strategy, results of operations or financial condition, there can be no guarantee that we will not experience a successful material threat or incident. Additional information on cybersecurity risks we face can be found in "Item 1A, Risk Factors" under the heading "We face risks from network disruptions or security breaches that could damage our reputation and harm our business and operating results."

companyName: FORRESTER RESEARCH, INC.

ticker: FORR


text: Our management team, including our Global CISO, Chief Information Officer, Managing Director of Global Infrastructure Services, and General Counsel, along with other key business and functional leaders, constitute our Security Steering Committee ("SCC") which is responsible for assessing and managing our material risks from cybersecurity threats. Our Global CISO and our Managing Director of Global Infrastructure Services have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Global CISO has extensive experience assessing and managing cybersecurity-related risks and implementing related policies, procedures, and strategies. Our Global CISO has served in leadership roles related to information security for over 23 years, including serving as a CISO at another company since 2015, then as DXC's IT CISO since May 2022 and as DXC's Global CISO since August 2024. Our Global CISO reports to our Managing Director of Global Infrastructure Services who is a well-known industry leader with more than 20 years of experience in the technology industry and has been with DXC since 2020.

companyName: DXC Technology Co

ticker: DXC


text: A cybersecurity incident response plan is in place that is designed to provide a framework across all functions for a coordinated identification and response to security incidents. The plan specifies the process for identifying, validating, classifying, documenting, and responding to cybersecurity events as well as determining whether reporting of an event is appropriate under regulatory standards. The plan also includes a materiality assessment framework that sets forth procedures to support our assessment of whether a security incident is "material" under the federal securities laws. Internal reporting and escalation protocols are in place to ensure the involvement of the CIO, other senior executive leaders, and the Audit Committee, as appropriate. Under the plan, regular tabletop exercises are conducted to test preparedness and incident response processes and provide ongoing training.

companyName: Spectrum Brands Holdings, Inc.

ticker: SPB


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and customer data ("Information Systems and Data").

companyName: Sprinklr, Inc.

ticker: CXM


text: The Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO") provide quarterly updates to the Audit Committee on information security, privacy risk and compliance, with updates to the Board at least annually.

companyName: TAPESTRY, INC.

ticker: TPR


text: Farmer Mac's process to identify and assess material risks from cybersecurity threats operates alongside Farmer Mac's broader overall risk assessment process that contemplates all company risks. As part of this process, appropriate personnel collaborate with subject matter specialists, as necessary, to gather information to identify and assess material cybersecurity threat risks, their severity, and potential mitigations.

companyName: FEDERAL AGRICULTURAL MORTGAGE CORP

ticker: AGM


text: Our daily operations are monitored by a dedicated information technology team. We conduct monitoring of our computer networks, and have implemented systems and processes intended to secure our information technology systems and prevent unauthorized access to or loss of sensitive data, including through the use of encryption and authentication technologies. We assess the adequacy of our cybersecurity measures through annual penetration testing of our computer networks by external consultants, and we have performed tabletop simulations and drills at both a technical and management level around scenarios involving the loss of critical information and technology systems.

companyName: ACADIA REALTY TRUST

ticker: AKR


text: Additionally, the management team of the Company has developed a cyber incident response plan to deploy in the event of a cyber threat. This plan is reviewed and updated at least annually and tested from time to time through tabletop exercises involving management and other key personnel, and may also include participation from the Board and outside experts. As part of regular business continuity planning, department heads are required to consider key technology systems used by their respective teams and the impact to the Company and other stakeholders in the event that such systems become compromised or unavailable. Additionally, we monitor and identify cybersecurity risks posed by third-party vendors who provide software and/or hardware to the Company or otherwise have access to our Company systems and have a cyber review process that is part of vendor onboarding.

companyName: Empire State Realty Trust, Inc.

ticker: ESRT


text: We enlist the support of third-party providers to bolster our cybersecurity risk management. These providers offer ongoing assistance, such as threat monitoring, mitigation strategies, updates on emerging trends and developments, and policy guidance. Additionally, we engage specific providers for targeted assistance, such as security and forensic expertise, as the need arises. Before sharing any sensitive data or integrating with a third-party provider, we conduct a thorough assessment of their security capabilities in alignment with our risk posture and request modifications as deemed necessary.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: of assets at risk from cybersecurity threats of potential sources of cybersecurity threats of the status of protections in place to prevent or mitigate cybersecurity threats that landscape, how to manage cybersecurity risks

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: We work to require our third-party partners and contractors to handle data in accordance with our data privacy and information security requirements and applicable laws. We regularly engage with our suppliers, partners, contractors, service providers and internal development teams to identify and remediate vulnerabilities in a timely manner and monitor system upgrades to mitigate future risk, and ensure they employ appropriate and effective controls and continuity plans for their systems and operations.

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: Cyber Governance & Oversight EOG's cybersecurity team reports to EOG's Senior Vice President and Chief Information and Technology Officer, who has served as EOG's Chief Technology Officer since 2017 and as EOG's Chief Information Officer for over 25 years.

companyName: EOG RESOURCES INC

ticker: EOG


text: We utilize certain third-party service providers to perform select functions. These third-party service providers also face cybersecurity threats, and a cybersecurity incident impacting any of our third-party service providers could also indirectly affect our operations, performance and results of operations. We have a data security committee, consisting of members from various BXP departments, including IS, legal and risk management, that meets periodically to assess, identify and manage cybersecurity risks related to certain third-party service providers and to protect our critical financial and sensitive business information, as well as personally identifiable information (collectively, "Sensitive Information"). The data security committee has implemented processes for evaluating the risk profile of those service providers that handle or have access to Sensitive Information, which informs applicable contractual obligations with these service providers. This evaluation, which occurs prior to onboarding, is designed to consider the nature of the services to be provided, the level of sensitivity and quantity of the information that the service provider handles or has access to, and the identity of the service provider.

companyName: BXP, Inc.

ticker: BXP


text: To date, the Company has not experienced a cybersecurity incident that has materially impacted our business strategy, results of operations, or financial condition. Addressing cybersecurity risks is a priority for the Company, and the Company is committed to enhancing its systems of internal controls and business continuity and disaster recovery plans.

companyName: FIRST BANCSHARES INC /MS/


text: We have a full-time information technology specialist who reports directly to our CEO and is responsible for assessing and managing cybersecurity risks. Both our information technology specialist and our CEO have extensive experience managing our cybersecurity. We have not engaged third-party service providers for cybersecurity, because we believe it is better to have the expertise in-house.

companyName: NVE CORP /NEW/

ticker: NVEC


text: To date, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a materially adverse effect on our business, including our business strategy, results of operations and financial condition. However, there can be no assurance that our processes and procedures will prevent or timely detect a cybersecurity incident. For more information regarding risks from cybersecurity threats, see the section entitled "Risk Factors—Risks Relating to Our Products—Risks Relating to Production and Distribution of Products."

companyName: Cronos Group Inc.

ticker: CRON


text: The Chief Technology Officer ("CTO") has over 13 years of experience in IT and cybersecurity leadership, including managing enterprise IT operations and technology risk. The CTO also holds a Certified Community Bank Information Technology Officer designation from the ICBA, and a CompTIA Security+ certification and has completed the Graduate School of Banking at the University of Wisconsin's Bank Technology Management program. Members of the Technology Steering Committee bring substantial experience in IT operations, cybersecurity, and risk management, providing guidance on technology strategy, operational performance, and cybersecurity oversight.

companyName: TIMBERLAND BANCORP INC

ticker: TSBK


text: Our IT Officer oversees the day-to-day management of the Company's cybersecurity risk management program. Our IT Officer has over 15 years of experience in IT leadership, and has managed IT for our company for approximately 10 years. Our IT Officer reports to our Chief Operating Officer and Chief Financial Officer and is a member of our Compliance Committee. Our IT Officer coordinates with our legal department and relevant third parties, such as consultants and external legal advisors, to assess and manage material risks from cybersecurity threats. Our IT Officer is also supported by a cross-functional incident response team, which is empowered to review, assess, report, monitor and take action to mitigate or remedy any cybersecurity incidents pursuant to our business continuity and incident response plan. Our IT department further supports and has dedicated resources to assist our IT Officer in monitoring, preventing, detecting, mitigating, and remediating any cybersecurity incidents pursuant to our policies and procedures.

companyName: TELA Bio, Inc.

ticker: TELA


text: Our cybersecurity incident response policy and plan are designed to escalate certain cybersecurity incidents to a Security Incident Response Team ("SIRT"), comprised of the CIO, CISO, GC, CCO and Senior Director of Engineering. The SIRT works with NetScout's incident response team to help NetScout mitigate and remediate cybersecurity incidents of which they are notified. In addition, NetScout's incident response plan includes reporting to the CEO and Chair of the Audit Committee of the Board of Directors for certain cybersecurity incidents. NetScout's Cybersecurity Disclosure Committee, which includes the SIRT and the CFO, assess the materiality of cybersecurity incidents for potential disclosure requirements according to an escalation process defined in NetScout's Cybersecurity Protocol for Disclosure Controls and Procedures.

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract manufacturing organizations, and supply chain resources. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management processes may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: MALIBU BOATS, INC.

ticker: MBUU


text: The Company relies on third-party service providers for critical or key infrastructure and solutions across various Company operations. Cybersecurity incidents that impact third-party service providers have significantly increased in recent years and represent a continuing risk to the Company. The Company has sought to mitigate this risk through specific cybersecurity controls, designed to assess the business and security controls implemented by key information services to the Company, which are annually audited and subject to oversight by management and the board of directors.

companyName: Vaxart, Inc.

ticker: VXRT


text: The Company relies on the Investment Adviser to engage external experts, including the IT MSP and cybersecurity consultants, to evaluate cybersecurity measures, including those applicable to the Company. The Company relies on the Investment Adviser's risk management program and processes, which include cyber risk assessments.

companyName: Brightwood Capital Corp I


text: The Company's management and Board recognize the importance of strong oversight of cybersecurity risk, information security and technology in maintaining the trust and confidence of our customers, partners, employees and stockholders. Our processes for assessing, identifying and managing material risks from cybersecurity threats is incorporated into our Enterprise Risk Management (ERM) program in a similar fashion to other legal, compliance, operational, and financial risk areas. The Company maintains cybersecurity measures aligned with the National Institute of Standards and Technology Cybersecurity Framework (Framework) which organizes cybersecurity risks into six categories: identify, protect, detect, respond, recover and govern, and looks to other standards as well to help identify, assess, and manage cybersecurity risks relevant to our business.

companyName: GENERAC HOLDINGS INC.

ticker: GNRC


text: actively monitoring and mitigating cybersecurity threats and risks with a three lines of defense structure to provide oversight, governance, challenge, and testing; managing a third-party cybersecurity oversight program;

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: Security Operation and Governance Our Board Chartered, IT Committee oversees implementation, monitoring, and assessment of cybersecurity risks as it relates to the comprehensive Information Systems Security Program (ISSP). In fulfilling its duties, the Committee ensures the development of appropriate policies. The Committee reviews and discusses policies, procedures, and projects with management and after taking into consideration any matters that the IT Committee may deem advisable, the IT Committee annually recommends such policies to the Board of Directors for review and ultimately approval.

companyName: River Financial Corp

ticker: RVRF


text: Internal and external stakeholders can access Jasper's Information Technology helpdesk 24/7 online or by phone, to report any security incidents for escalation.

companyName: Jasper Therapeutics, Inc.

ticker: JSPR


text: We use third-party service providers to perform a variety of functions throughout our business, including but not limited to application providers and hosting companies. All of our critical information is hosted by a third-party service provider. Further, we also rely upon such third-party service providers to both assist us in identifying cybersecurity threats, as well as to review and notify us of any data breach on their systems.

companyName: TherapeuticsMD, Inc.

ticker: TXMD


text: We conduct due diligence on third-party vendors and service providers that store or process sensitive company information. Our processes include a security review and implementation of procedures to receive and review security updates and alerts from such third parties.

companyName: Damora Therapeutics, Inc.

ticker: DMRA


text: Honda, including AHFC and HCFI, have been targeted by cyber-attacks in the past; however, no risks from cybersecurity threats have been identified that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, over the past three fiscal years. See "Item 1A. Risk Factors—General Risk Factors—A security breach or a cyber-attack may adversely affect our business, results of operations and financial condition."

companyName: AMERICAN HONDA FINANCE CORP


text: While extensive cybersecurity controls and procedures are in place, the risk of experiencing an incident can never be eliminated completely. We maintain and regularly review and update an Incident Response Plan that outlines procedures for identifying, containing, and mitigating any cyber event that may affect our systems, data, or operations and includes potential credit monitoring services, customer and regulatory notification guidelines and templates. This plan is regularly tested and updated. The plan is designed to address adverse events that could impact the security of information, that affect our ability to conduct secure financial transactions, or that present reputational risk. We have retainers in place with privacy counsel and forensic incident response firms.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: Management is responsible for the day-to-day handling of risks facing our Company Our Board of Directors, as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated risk management responsibilities with respects to cybersecurity to our Audit Committee. Specifically, the Audit Committee periodically reviews our cybersecurity policies, data security programs and plans that management has established to monitor compliance and assess preparedness. Our cybersecurity team is led by our CISO, who has over 20 years of experience in the cybersecurity space and is a Certified Information Security Manager (CISM). On an annual basis, at minimum, our CISO or Chief Information Officer (CIO) present necessary updates on our cybersecurity risks and any material cybersecurity incidents. These updates include the following: (i) current cybersecurity threats, (ii) an overview of third-party risks, (iii) our cybersecurity roadmap, (iv) the maturity of our cybersecurity programs and/or (v) ongoing regulatory compliance.

companyName: Surgery Partners, Inc.

ticker: SGRY


text: Our CISO has more than 25 years of experience in the cybersecurity and technology space. Our Data Security Committee is composed of key business and functional stakeholders including Risk, Legal, Finance, IT, Operations, and Business line leads.

companyName: INVESTORS TITLE CO

ticker: ITIC


text: Related to Cybersecurity Risks Our management, with involvement and input from our audit committee, performs an annual enterprise-wide risk management (ERM) assessment to identify and manage key existing and emerging risks for our company. Our ERM process seeks to identify both the potential impacts to our company of a particular risk and the likelihood and proximity of any such risk. Our management team is responsible for implementing and overseeing our ERM process. Cybersecurity is among the risks identified for board of directors' level risk oversight as a result of our most recent ERM assessment, with our audit committee of the board of directors having been delegated responsibility for overseeing our policies, practices and assessments with respect to cybersecurity and other information technology risks.

companyName: Blueprint Medicines Corp


text: We are intensely focused on protecting the security of our products; our guiding principle of "secure by design" underlies all of our product development. We have a cybersecurity team embedded with our research and development group to deliver on this mission as well as a Product Cybersecurity Risk Management Policy which is aligned with FDA guidance. Omnipod DASH was the first FDA-cleared insulin pump certified under the Diabetes Technology Society's "Standard for Wireless Diabetes Device Security" cybersecurity assurance standard and program, known as DTSec. This certification is a cybersecurity standard intended to raise confidence in the security of network connected medical devices through independent expert evaluation. Omnipod 5 incorporates cybersecurity by design principles, which includes secure data transfer between the Pod, Controller, cloud storage, and compatible continuous glucose monitors. Our Secure Software Development Lifecycle enforces application testing and continuous monitoring to identify security risks. Omnipod 5 is certified by ISO 27001 and the U.K. Cyber Essentials. Omnipod 5 incorporates authentication, encryption, and cybersecurity protection to ensure only trusted devices and authorized people can access the system.

companyName: INSULET CORP

ticker: PODD


text: We have not, to date, identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations, or financial condition.

companyName: Future FinTech Group Inc.

ticker: FTFT


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks. The program includes regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our Audit Committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer, Chief Legal Officer, Chief Information Officer and Director of Information Security.

companyName: ASPEN AEROGELS INC

ticker: ASPN


text: The leadership of our cybersecurity risk management and strategy is guided by experts from our Software, Infrastructure Engineering, and Executive teams. With backgrounds spanning: information technology, security, systems, programming, and corporate strategy, these individuals are equipped to oversee prevention, detection, mitigation, and remediation of cybersecurity incidents. They actively engage in managing our cybersecurity risk processes, including executing our incident response plan, and regularly report relevant matters to the executive management and the Audit Committee.

companyName: SPAR Group, Inc.

ticker: SGRP


text: Our CISO, who has extensive cybersecurity knowledge and skills gained from over 25 years of relevant work experience, and is a Certified Information Systems Security Professional, is responsible for assessing, monitoring and advising the Company's various business units, management and the Board on risks from cybersecurity threats; implementing cybersecurity strategy, programs and processes across our enterprise and connected products and services; reviewing the risk management measures implemented by the Company to identify and mitigate cybersecurity risks; and overseeing the maintenance and deployment of the Cybersecurity Incident Response Plan. The CISO leads the Company's Cybersecurity Team ("Team"), comprised of individuals with a broad range of cybersecurity skills, experiences and certifications. The Team is responsible for the implementation, monitoring and maintenance of the Company's cybersecurity practices in coordination with its businesses, operations and functions, and oversees the Company's cybersecurity program.

companyName: Xylem Inc.

ticker: XYL


text: We have designed our program taking into account the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and Center For Internet Security ("CIS") Controls. These standards, along with other industry benchmarks, such as the PCI DSS, are used as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business, but this does not imply that we meet any particular technical standards, specifications, or requirements at all times.

companyName: Shift4 Payments, Inc.

ticker: FOUR


text: Third-Party and Vendor Risk Management Our vendor and partner management processes include security due diligence, contractually required safeguards, and—in relevant cases—direct review of their cybersecurity practices. We require certain vendors with access to sensitive systems or data to undergo security training or meet specific security certification requirements.

companyName: PETMED EXPRESS INC

ticker: PETS


text: The Company's cybersecurity team, which is led by our CISO, oversees the Company's cybersecurity and data security operations, programs, policies and processes and their general effectiveness. The cybersecurity team, in coordination with other Incident Response Team members, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents. The Company's Incident Response Team consists of our CISO and other senior leaders from the Company's cybersecurity (composed of information security and technology operations), compliance, legal, financial reporting and other key business and corporate functions. The CISO and other Incident Response Team members monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with the incident response plan. The team is also responsible for informing and coordinating with the Company's Disclosure Committee in timely reporting such incidents, as appropriate and depending on the severity of the incident, and facilitating updates to the Strategy Board (consisting of our CEO, Chief Financial Officer (CFO), General Counsel, CIO and other members of management), Audit Committee and Board regarding such incidents until addressed.

companyName: PHINIA INC.

ticker: PHIN


text: The Company's cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats. The Company relies on Saratoga Investment Advisors to implement the cybersecurity program. The cyber risk management program involves risk assessments relating to the information systems of Saratoga Investment Advisors, incident response training and testing, implementation of security measures, identification of sensitive information assets ("Critical Information") and ongoing monitoring of systems and networks and assessment of the associated risks on an annual basis, including networks on which the Company relies on. The Chief Compliance Officer, along with the Company's external information technology consultant (the "IT Consultant"), actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. The Company and Saratoga Investment Advisors have engaged external experts, including consultants, such as the IT Consultant, to evaluate cybersecurity measures and risk management processes, and depends on and engages various third parties, including suppliers, vendors, and service providers. The compliance team of the Company and Saratoga Investment Advisors will conduct ongoing due diligence of its significant service providers to determine whether the cybersecurity programs of service providers include, among other things, procedures and safeguards designed to ensure the protection of Critical Information and the information of the Company's stockholders and portfolio companies, as well as adequate responses in the case of a cybersecurity incident.

companyName: SARATOGA INVESTMENT CORP.

ticker: SAR


text: The Audit Committee of our Board oversees our cybersecurity risk. The Audit Committee receives regular cybersecurity specific updates from management (including our CSO and/or other key personnel), typically on a quarterly basis, about the prevention, detection, mitigation, and remediation of cybersecurity threats and cybersecurity incidents, as well as the evolving cybersecurity landscape, recent program enhancements and other relevant topics. The Audit Committee reports to our Board and a number of our Audit Committee and Board members have experience in assessing and managing cybersecurity risks. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated to the Audit Committee and/or the Board on an as-needed basis.

companyName: Rackspace Technology, Inc.

ticker: RXT


text: The CISO, in coordination with the CRO, CIO and General Counsel, works across the Company to implement and monitor a program designed to protect the Company's information systems from cybersecurity threats and promptly respond to any cybersecurity incidents in accordance with the Company's cybersecurity incident response plan. The Company's CISO has served in various roles in information technology and information security for over twenty years, including serving as a Cyberspace Operations Officer in the United States Air Force Reserves and instructing for the SANS Technology Institute. The Company's CISO holds an undergraduate degree in Business Administration and has attained the professional certification of Certified Information Systems Security Professional ("CISSP") and multiple GIAC certifications. The Company's CRO has over a 25-year career in the banking industry and is currently serving as Senior Executive Vice President and Chief Risk Officer of Stellar Bank and Chief Risk Officer of Stellar Bancorp, Inc. Previously, the CRO has held the positions of President and Chief Risk Officer at Allegiance Bank and Executive Vice President and Chief Risk Officer at Allegiance. The Company's CRO's banking career as an executive started at Independence Bank in 2002 as Senior Credit Officer and eventually was promoted to President in 2009. Between 2010 and 2013, the CRO also served as CEO of Independence Bank until joining Allegiance Bank following a merger. The Company's CRO has since assumed the roles of Regional President, Deputy Chief Credit Officer, and Chief Administration Officer at Allegiance Bank. The CRO holds an MBA from the University of Houston and a Bachelor of Arts in Finance & Marketing from the same institution.

companyName: Stellar Bancorp, Inc.

ticker: STEL


text: Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers. For example, as part of our contract management process, we conduct IT security reviews, and require executive approval by the General Counsel, Chief Financial Officer and Executive Vice President of Global Operations in relation to products or services that could potentially expose our company to cybersecurity risks.

companyName: CIRRUS LOGIC, INC.

ticker: CRUS


text: Cyber Security Governance and Oversight Our Board of Directors maintains ultimate oversight over risk functions but has delegated certain oversight responsibilities for enterprise and operational risks, including cybersecurity risk, to the Board's Risk and Compliance Committee. The Risk and Compliance Committee's obligations include overseeing Jack Henry's risk assessment and management programs and reviewing risk preparedness. Our Audit Committee oversees financial risks and would also be informed of a material cybersecurity incident that could potentially have a material impact on our financial statements. The Chief Information Security Officer ("CISO") reports to the Risk and Compliance Committee and to the full Board of Directors on a quarterly basis on information security matters. Additionally, the CISO meets with the Risk and Compliance Committee at least annually to evaluate our overall security environment and organization.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: Role of Management One of the key functions of our executive officers, in connection with our IT team, is informed oversight of our risk management process, which includes risks from cybersecurity threats. Our executive ooficers monitor and assess strategic risk exposure, and manage the material risks we face.

companyName: Hawkeye Systems, Inc.

ticker: HWKE


text: We aim to incorporate industry practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage cybersecurity risks. Our cybersecurity program is informed by applicable industry standards and is assessed regularly by independent third-party auditors.

companyName: Zymeworks Inc.

ticker: ZYME


text: We collaborate with external cybersecurity service providers, including auditors, consultants and governmental agencies, to refine our cybersecurity measures. These service providers carry out cybersecurity risk evaluations such as periodic assessments and vulnerability scans to pinpoint potential security flaws and suggest enhancements. In addition, we employ third-party technology and other solutions to enhance our protection against cybersecurity risks. These solutions include our use of a managed security service provider to support our in-house technology team, an endpoint detection and response, or EDR, system for ongoing surveillance, detection, and action against threats, as well as a security information and event management, or SIEM, system designed to automate the real time identification, investigation and prioritization of critical alerts.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: Dime's Cybersecurity Incident Response and Business Continuity Programs are inclusive of cyber resiliency, business continuity and disaster recovery strategies to help mitigate the impact of a cybersecurity incident across all business lines. Management Role and Board Oversight.

companyName: Dime Community Bancshares, Inc. /NY/

ticker: DCOM


text: Travis Smith, age 50, is Senior Vice President with responsibility for the AFP segment. Mr. Smith joined the Company in December 1992 as a chemical engineer and has held various positions of increasing responsibility within manufacturing, the chemicals business, corporate innovation, specialty plastics, and advance materials during his career at Eastman. Mr. Smith assumed the position of Vice President and General Manager, Performance Films in July 2012 and for both Performance Films and Advance Interlayers in April 2018. Mr. Smith was appointed to his current position effective October 2022.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: bEvaluating third-party vendors for compliance with our cybersecurity standards and requiring them to maintain appropriate security controls to protect our data. aMaintaining a cybersecurity incident response plan that outlines procedures for responding to and managing cybersecurity incidents.

companyName: IREN Ltd

ticker: IREN


text: The primary objective of our security program is to prevent, detect and respond to security risks and threats to protect the confidentiality, integrity and availability of our information systems and our sensitive data. Our cybersecurity program approach is risk-based, using continuous threat modeling to help us identify, track and measure our progress to reduce security risk based on three pillars: • Prevention, through planning and designing solutions to implement security controls. The security functions that support prevention efforts are aligned with security architecture, strategy and risk management activities; • Detection and response activities, which enable us to discover and respond to cybersecurity events in a timely manner. When a potentially damaging or threatening cybersecurity event is detected, our security operations team, focused on delivering detection and response services, executes the appropriate cybersecurity incident response plan; and • Governance and compliance, through cross-functional engagement, good operational hygiene and consistent discipline. Ongoing stakeholder collaboration, communications and training within a well-defined policy framework aligned with industry standards is foundational for strong governance and effective compliance. As part of the policy framework, operating procedures are kept up-to-date to reflect the current state of execution and to drive investment and iterative improvements in the highest priority areas of the security program. See Governance below for additional detail.

companyName: Dine Brands Global, Inc.

ticker: DIN


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Head of Information Technology, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Unity Biotechnology, Inc.


text: –Executive Management – Technology Governance Committee: The Technology Governance Committee consists of certain members of executive management, including the Chief Accounting Officer, Chief Digital and Technology Officer, Chief Commercial Officer, Chief Strategy Officer, and Corporate Vice President, IT Infrastructure Operations and Security. This committee evaluates projects involving information technology, including reviewing best practices and change management needs and communicating a company-wide approach. Therefore, the information technology department is aware of system and application implementations prior to execution to facilitate proper application and infrastructure security both during implementation and after implementation. Internal audit is notified of system and application implementations as part of this process as well. The internal audit department works with the information technology department to review information technology projects to ensure key projects are appropriately planned, designed, developed, tested, deployed and maintained, including verifying proper security both during and after implementation.

companyName: Six Flags Entertainment Corporation/NEW

ticker: FUN


text: The Board of Directors is responsible for overseeing the Company's enterprise risk, and has established its Risk and Cybersecurity Committee with specific responsibility for overseeing cybersecurity threats, among other things. The Company's cybersecurity organization is led by the CTO, who is responsible for assessing and managing material risks from cybersecurity threats and reports to Usio's CEO, CAO, and Legal team, as well as to the Risk and Cybersecurity Committee. The CTO has served in this role for 17 years, and more than 21 years with the Company developing, maintaining, and securing our corporate network and information technology systems. The CTO holds a bachelor's degree in information technology from the University of Texas at San Antonio with over 11 years of previous software and hardware systems engineering experience.

companyName: Usio, Inc.

ticker: USIO


text: The audit committee of the Company's Board of Directors is responsible for overseeing management's information technology steering committee as well as management's risk assessment and risk management processes designed to monitor and control cybersecurity threats. Management's steering committee, led by the Company's chief information officer, regularly briefs the audit committee on cybersecurity matters. These briefings generally occur on a quarterly basis. In the event we experience a cybersecurity incident that could materially affect us, including our business strategy, results of operations or financial condition, the Company's chief information officer and other members of management's steering committee (which include executive officers who are also part of our disclosure committee) would review the incident with the audit committee to consider whether and to what extent disclosure is required under Item 1.05 of Form 8-K.

companyName: HIGHWOODS PROPERTIES, INC.

ticker: HIW


text: To date, we have not experienced any material cybersecurity incidents. We remain subject to the risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.

companyName: Comstock Holding Companies, Inc.

ticker: CHCI


text: We have implemented standard operating procedures to define the channels by which cybersecurity threats are communicated to the Board. This ensures that Board has oversight and effective governance in managing risks associated with cybersecurity threats.

companyName: SAB Biotherapeutics, Inc.

ticker: SABS


text: As discussed above, our CIO and CISO also provide regular reports regarding risks from cybersecurity threats to our Audit Committee and, depending on the materiality of a risk, the full Board. In addition, from time to time, members of management may provide reports to a special committee of the Board for cybersecurity.

companyName: MKS INC

ticker: MKSI


text: Our CISO is part of the risk management function, reporting directly to the Chief Risk Officer, who in turn, reports directly to our CEO. Various management committees provide oversight of the information security and technology programs. These committees generally meet quarterly, and summaries of key issues discussed and actions taken are provided to the Risk Committee.

companyName: FIRST COMMONWEALTH FINANCIAL CORP /PA/

ticker: FCF


text: The Management Risk Committee is comprised of various members of Senior Management, Department Leaders, Compliance, Internal Audit and Risk Management. The Management Risk Committee is responsible for loss control and day-to-day oversight of the risk management function. Management Risk Committee meetings are held monthly. Results of the monthly review of risk categories are reported to the Board of Directors Enterprise Risk Management Committee (ERM) each quarter. In addition, the Company's risk position is reported to the Board of Directors quarterly.

companyName: FARMERS & MERCHANTS BANCORP INC

ticker: FMAO


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight through the audit committee.

companyName: ProPhase Labs, Inc.

ticker: PRPH


text: Our regular interactions with third-party vendors and suppliers pose a cybersecurity risk that could adversely impact our business or employees. We conduct information security assessments before onboarding and upon detection of an increase in risk profile. In addition, we require providers to meet appropriate security requirements, controls and responsibilities and include additional security and privacy addenda to our contracts where applicable.

companyName: Avalo Therapeutics, Inc.

ticker: AVTX


text: We do not specifically utilize assessors, consultants, auditors, or other third parties to evaluate or enhance our cybersecurity programs. On an annual basis, our information technology risks, controls and procedures are reviewed by third-party experts as part of our Sarbanes-Oxley review and testing.

companyName: Traws Pharma, Inc.

ticker: TRAW


text: Cybersecurity risk management is a component of the company's broader enterprise risk management program and we have established cybersecurity policies and procedures to protect against and mitigate harm from cybersecurity incidents. We respond to cybersecurity incidents in accordance with our cybersecurity policies and procedures and applicable law. Rackspace maintains a cross-functional approach to cybersecurity risk, which is designed to help prevent, identify, assess, manage, mitigate, and respond to cybersecurity threats.

companyName: Rackspace Technology, Inc.

ticker: RXT


text: The Company recognizes the critical importance of developing, implementing, and maintaining good cybersecurity measures to safeguard its information systems and protect its data's confidentiality, integrity, and availability.

companyName: ELECTRAMECCANICA VEHICLES CORP.


text: Our information security team and members of IT also monitor the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with law enforcement, regulators, and external consultants we may engage, and reports produced by security tools we have deployed in our IT environment.

companyName: Carter Bankshares, Inc.

ticker: CARE