text: We use a layered approach designed to mitigate the constantly evolving risks from cybersecurity threats by investing in people, processes, and cybersecurity technologies. Our approach is informed by recognized industry standards and frameworks, and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and the Center for Internet Security ("CIS") critical security controls.

companyName: Anika Therapeutics, Inc.

ticker: ANIK


text: Board of Directors is responsible for the strategic leadership and direction of our cybersecurity program. Our Board has oversight over cybersecurity risks. Our management provides periodic presentations to the Board on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable.

companyName: Cannaisseur Group Inc.

ticker: TCRG

secItem: Item 1C


text: We have leveraged the support of third-party information technology and security providers, including to perform a risk assessment designed to identify, assess, and manage cybersecurity risks. Further, we follow a formal, documented process to assess the data protection practices of certain third-party vendors that handle sensitive information on our behalf.

companyName: Eightco Holdings Inc.

ticker: ORBS


text: The AGM board of directors ' oversight of cybersecurity risk management is supported by the audit committee of the AGM board of directors (the "AGM audit committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. The AGM board of directors, the AGM audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo ' s information technology, cybersecurity risk profile and strategy, and risk mitigation plans from Apollo ' s risk management professionals, the AGM's Chief Security Officer ("CSO"), AGM's CISO, other members of management and relevant management committees and working groups. The Cyber Security Working Group is chaired by AGM's CISO and has representation from Apollo ' s Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. AGM's CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM ' s board of directors and/or the AGM audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM board of directors or the AGM audit committee receives presentations and reports on cybersecurity risks from AGM ' s CSO or CISO, as well as from AHL ' s CISO, at least annually.

companyName: Apollo Commercial Real Estate Finance, Inc.

ticker: ARI


text: Our approach to cybersecurity risk management includes the following key elements: • Multi-Layered Defense and Continuous Monitoring: Our approach to cybersecurity involves multiple layers of defense, incorporating detection capabilities, analytics, and real-time monitoring. We utilize data insights to identify potential anomalies, monitor evolving threats, and identify emerging risks. Safeguards are regularly evaluated and refined based on vulnerability assessments, threat intelligence, and insights gained from monitoring activities. • Information Sharing and Collaboration: We share and receive threat intelligence with industry peers, government agencies, Information Sharing and Analysis Centers ("ISACs"), trade organizations, and cybersecurity forums. These collaborations provide a means for information exchange to improve threat detection and vulnerability mitigation. • Third-Party Risk Assessments: We engage independent firms to assist with multiple phases of our cybersecurity program. This work includes testing, audits, and consulting to validate and strengthen our cybersecurity posture, and the design and operational effectiveness of our controls. • Companywide Policies and Procedures: Our companywide cybersecurity policies and procedures cover areas such as encryption standards, endpoint security, remote access protocols, multi-factor authentication, and data protection. These policies undergo regular review to address the latest security standards and operational requirements, and to consider best practices and industry trends. • Training and Awareness: We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees routinely participate in simulated phishing campaigns, education that reinforces compliance with our policies, standards and practices, and other awareness training. We also periodically perform tabletops and other exercises with management and incorporate external resources and advisors as needed. Our cybersecurity team collaborates with stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation and remediation strategies. • Supplier Engagement: We work collectively with our suppliers to support cybersecurity resiliency in our supply chain. The Company uses a variety of processes to address third-party cybersecurity threats, including reviewing the cybersecurity practices of such provider(s), contractually imposing obligations on the provider(s), notifications in the event of any known or suspected cyber incident, conducting security assessments, and periodic reassessments during the course of the Company's engagement with such provider(s).

companyName: CHESAPEAKE UTILITIES CORP

ticker: CPK


text: The Company has designated the MAT to assess and oversee the management and reporting of identified potentially material cybersecurity threats or incidents. The MAT convenes when a qualifying cybersecurity threat is identified by the CIO, the CISO, or their designees in accordance with established processes and procedures. The MAT has the responsibility to determine whether a cybersecurity threat or incident is material and oversee appropriate reporting. The MAT is also responsible for communicating to the Risk Committee any material cybersecurity threats or incidents.

companyName: BankUnited, Inc.

ticker: BKU


text: AMN's information and cybersecurity program reports up to our Chief Information & Digital Officer ("CIO") and is managed by our Vice President, Information & Cyber Security, whose team is responsible for leading our enterprise-wide cybersecurity strategy. Through ongoing communications with the team, the CIO and the Vice President, Information & Cyber Security, are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents and progress on cybersecurity infrastructure initiatives. In the event of a material cybersecurity incident, the CIO, in coordination with AMN's Chief Legal Officer, will escalate to the Audit Committee and the Board is made aware as appropriate and in accordance with AMN's incident response plan. Our CIO and Vice President, Information & Cyber Security have proven experience as technology leaders establishing and overseeing enterprise information security programs in the healthcare industry. Our CIO has over 25 years of experience serving as Chief Information Officer, Senior Vice President of IT, and Director of IT at various healthcare services and technology companies. AMN's Vice President, Information & Cyber Security has over 20 years of experience in various roles in information technology and information security. He holds a M.Sc. in Computer Information Systems and holds several relevant certifications, including Certified Information Security Manager and Zero Trust Certified Architect.

companyName: AMN HEALTHCARE SERVICES INC

ticker: AMN


text: The Board of Directors has responsibility for approving and overseeing management's policies related to information system security and cybersecurity threats and incidents. They also supervise management's overall approach to securing the company's information systems. The Board of Directors delegates the oversight of cybersecurity risk management to the Information Technology Committee of the Board.

companyName: CHOICEONE FINANCIAL SERVICES INC

ticker: COFS


text: The Company recognizes the importance of developing, implementing and maintaining cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of its data. The Company maintains a cybersecurity program to assess, identify and manage cybersecurity threat risks. The Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities and tests those systems pursuant to the Company's cybersecurity policies, processes, and practices, which are integrated into the Company's overall risk management process. To protect the Company's information systems from cybersecurity threats, the Company uses various security tools and personnel that help the Company identify, escalate, investigate, resolve, and recover from security incidents.

companyName: Global Indemnity Group, LLC

ticker: GBLI


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of IT Operations and Security and Principal Accounting Officer.

companyName: Bolt Biotherapeutics, Inc.

ticker: BOLT


text: We also consider and evaluate cybersecurity risks associated with KBHS and third-party service providers that we have identified as having the greatest potential to expose us to cybersecurity threats. We have established due diligence procedures with KBHS and such third-party service providers, as well as communication channels as part of their breach and incident response processes. We also review annually the System and Organization Controls reports of third-party vendors hosting our data to ensure they maintain adequate access management controls including physical safeguards, disaster recovery capabilities, data privacy and notification processes, onboarding processes, incident response procedures and periodic independent testing of the vendor capabilities. We depend on our third-party service providers, KBHS and outside service providers to our customers with whom we share some personal identifying and confidential information to secure the information they receive from us.

companyName: KB HOME

ticker: KBH


text: The Company also contractually requires suppliers, vendors and other third-parties with access to its information technology systems, sensitive business data or personal information to implement and maintain appropriate security controls and contractually restricts their ability to use the Company's data, including personal information, for purposes other than to provide services to the Company, except as required by law.

companyName: TORO CO

ticker: TTC


text: Our cybersecurity risk management and privacy programs play a central role in the protection of the confidential information of our members, team members, and business partners, and, as such, are critical to the successful operation of our business.

companyName: CENTENE CORP

ticker: CNC


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the CIO and the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: UNIVERSAL STAINLESS & ALLOY PRODUCTS INC


text: From a management perspective, our Chief Information Security Officer ("CISO") and Senior Vice President and Chief Information Officer ("CIO") lead our cybersecurity efforts. Our CISO has extensive experience in cybersecurity, including creating and supporting cybersecurity programs for larger publicly-traded companies, obtaining cybersecurity certifications, participating in relevant cybersecurity leadership communities, and public speaking engagements on cybersecurity topics. He leads a cross functional cybersecurity team, which includes members of our legal department and internal audit function. As part of his job function, our CISO is charged to remain informed of the latest developments in cybersecurity, including the evolving threat landscape, as well as risk management improvement methods. This continual focus and understanding of the threat landscape, as well as risk treatment practices, is required to ensure that the CISO can effectively manage the Company's efforts to prevent, detect, mitigate, and remediate cybersecurity incidents.

companyName: Enpro Inc.

ticker: NPO


text: Mr. Bonnett is a Certified Public Accountant, Certified Internal Auditor, and Certified Information Systems Auditor. He holds a Bachelor of Science in Business Administration with a concentration in Accounting obtained from Concord University in 2010, from which he graduated valedictorian of his class. He is a recipient of the Executive Leadership Certificate from the University of Pennsylvania's Wharton School of Business and is a graduate, volunteer, and Capstone Advisor to students of the American Bankers Association's Stonier Graduate School of Banking.

companyName: FIRST COMMUNITY BANKSHARES INC /VA/

ticker: FCBC


text: As of the time of this filing, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial conditions. Refer to "Risk Factors" in Part I, Item 1A in this Annual Report on Form 10-K under the heading "Cybersecurity breaches and other disruptions could compromise our information and expose us to liability, which would cause our business and reputation to suffer," for additional discussion about cybersecurity related risks.

companyName: SUN COMMUNITIES INC

ticker: SUI


text: As part of its oversight function, the Board plays an active role, both as a whole and at the committee level, in overseeing management of YETI's cybersecurity risks. The Audit Committee has primary oversight responsibility for our overall enterprise risk assessment and risk management policies and systems, which includes risks related to our information technology and security systems, processes, and procedures, including risks related to cybersecurity threats. The Audit Committee receives quarterly presentations regarding our enterprise risk management program, including reports from our Director of Cybersecurity, on information security matters (such as cybersecurity risk and developments), as well as the steps management takes to monitor and control such exposures. These presentations address, among other things, the results of the most recent assessment or testing of our security information systems and our cybersecurity measures; the current threat environment; and cybersecurity trends and best practices. As applicable, these quarterly presentations also include reports of cybersecurity incidents affecting our information systems along with updates on the status of prior cybersecurity incidents and applicable remediation efforts. Such quarterly presentations given to the Audit Committee are summarized and shared with the Board at its next meeting by the Audit Committee Chair. Outside of such quarterly presentations, senior leadership would be expected to update the Audit Committee and the Board in real time of incidents deemed material and requiring disclosure in a Securities and Exchange Commission filing or of other "critical" or "high" severity incidents (the highest severity tiers under our incident response plan) that in senior leadership's discretion require more immediate Audit Committee attention. In addition, the internal audit team provides quarterly cybersecurity updates to either the Audit Committee or the full Board regarding our risk analyses, assessments, risk mitigation strategies, and activities. As described above, management is responsible for our day-to-day risk management activities and identifies and manages areas of material risk, which includes information technology and security. Our Chief Financial Officer oversees our Information Technology team, which includes the Director, Cybersecurity. Our Chief Legal Officer oversees our Compliance team, which includes our Director, Technology Compliance. We believe that such cross-departmental involvement promotes a collaborative approach to protecting the Company's information systems from cybersecurity threats, detecting cybersecurity incidents and responding to cybersecurity incidents in accordance with our incident response plan. Through the practices and policies described above, including our incident response plan, our Director, Cybersecurity and Director, Technology Compliance are informed about cybersecurity threats and incidents affecting our information systems and lead the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time. Incidents deemed "critical" or "high" are immediately escalated to the Chief Financial Officer, Chief Legal Officer, other senior leadership, and the Audit Committee.

companyName: YETI Holdings, Inc.

ticker: YETI


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit and compliance committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Immunocore Holdings plc

ticker: IMCR


text: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management has been delegated to the Audit, Finance and Risk Committee of the Board (the "Audit Committee"), which interacts with the Company's ERM function, the Company's Global Vice President of Information Technology, the Company's Director of Cyber Security, and other members of management and relevant management committees and councils.

companyName: FUELCELL ENERGY INC

ticker: FCEL


text: Company's technology team is primarily responsible for assessing, monitoring and managing our cybersecurity risks. The technology team ensures that all industry standard cybersecurity measures are functioning as required to prevent or detect cybersecurity threats and related risks, and provides briefings on cybersecurity threats and related risks to our Chief Executive Officer on a regular basis.

companyName: Freight Technologies, Inc.

ticker: FRGT


text: Triton maintains a cybersecurity risk management program designed to identify, protect, detect and mitigate cybersecurity threats and ensure the reliability of our system applications and infrastructure (our "Information Security Program"). Our Information Security Program, which is integrated within the Company's enterprise risk management framework, leverages recognized best practices and standards, including the National Institute of Standards and Technology cybersecurity framework, and is comprised of a robust set of cybersecurity tools, processes and procedures as further described below.

companyName: Triton International Ltd

ticker: TRTN-PA


text: Additionally, at least annually, our chief audit executive, who manages the day-to-day activities of our ERM program, reports to our Board of Directors on enterprise risk assessment under our ERM program, providing updates on key risks, status of mitigation efforts and residual risk trends, including an analysis of cybersecurity risks. Also at least annually, our Chief Information Security Officer reports to our full Board of Directors on cybersecurity matters related to or impacting our company and our business.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: Our information security program is subject to periodic internal audits and independent third-party reviews. We use third party security firms for security consulting, including configuration reviews and assessments, as well as performing periodic (no less frequently than annual) penetration tests to evaluate the integrity of our systems. We also conduct internal monitoring and testing activities, such as phishing simulations.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, the Company engages with a range of external experts, including cybersecurity consultants, in evaluating, monitoring, and testing Arcosa's cyber management systems and related cyber risks. The Company's collaboration with these third parties includes audits, threat and vulnerability assessments, incident response plan testing, company-wide monitoring of cybersecurity risks, and consultation on security enhancements.

companyName: Arcosa, Inc.

ticker: ACA


text: Team members who support our cybersecurity governance program have relevant education and industry experience. The team provides regular reports to senior management and other relevant teams on various cybersecurity threats, assessments, and findings.

companyName: Titan Machinery Inc.

ticker: TITN


text: Third-party service providers are managed through an established third-party risk management program. This includes processes to identify and assess cyber risk associated with the third-party service following a phased lifecycle including due diligence and selection, ongoing oversight and monitoring, and termination and exit planning. Third-party service providers are also required to notify the Company through established channels of any cyber incidents that may impact services or customers. Risks identified through any of these programs are managed via an enterprise issue management process.

companyName: Santander Holdings USA, Inc.


text: The CIO also coordinates with the Company's legal counsel and third parties, such as consultants and legal advisors, to assess and manage material risks from cybersecurity threats. Our CIO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes.

companyName: ASBURY AUTOMOTIVE GROUP INC

ticker: ABG


text: In 2024, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including with respect to our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity threat or incident. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Corporation, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors — Operational Risks.

companyName: Waterstone Financial, Inc.

ticker: WSBF


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those third parties upon which we rely or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits and other adverse consequences."

companyName: VYNE Therapeutics Inc.

ticker: VYNE


text: We prioritize investment in cybersecurity risk management and governance. We continually assess the adequacy of our resources and capabilities to address emerging threats, regulatory requirements and changes in technology. As cybersecurity threats evolve, we may need to further enhance our processes and technologies, which could require additional financial resources.

companyName: AYTU BIOPHARMA, INC

ticker: AYTU


text: Our board has the ultimate oversight of cybersecurity risk, which it manages through our enterprise risk management program. Our board has delegated primary responsibility of overseeing cybersecurity risks to the Audit Committee. The Audit Committee's responsibilities include reviewing cybersecurity strategies with management, assessing processes and controls pertaining to the management of our information technology operations and their effectiveness and making sure that management's response to potential cybersecurity incidents is timely and effective. At least annually, the Audit Committee reviews with the management team our cybersecurity risk exposures and the steps that management has taken to monitor and control such exposures. This review may cover a variety of relevant topics, potentially including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations related to our operators, managers and other third-party partners. The scope and focus of each review are determined based on current priorities and emerging issues in cybersecurity. In addition, we engage third-party consultants to test our IT control effectiveness throughout the year, and any known exceptions and test results are communicated to management and the Audit Committee on a quarterly basis.

companyName: American Healthcare REIT, Inc.

ticker: AHR


text: We also work with managed cybersecurity service providers to support real-time threat monitoring and incident response capabilities. Penetration testing and vulnerability scanning are performed periodically, and findings are reviewed with senior leadership.

companyName: Ocean Power Technologies, Inc.

ticker: OPTT


text: In alignment with industry standards, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, and Finance Agency regulatory guidance, we have implemented processes for assessing, identifying, and managing cybersecurity risk through a layered approach throughout our environment and in our service provider arrangements, including software-as-a-service and infrastructure-as-a-service engagements. We continuously evaluate and update our policies and practices to mitigate our exposure to cybersecurity risks given, among other things, the evolving natures of these risks, the involvement of uncontrollable circumstances, such as fires or flooding, and our role in the financial services industry and the broader economy. Our cybersecurity risk-mitigating processes include the implementation of firewalls, anti-virus software, real-time network monitoring, various forms of testing, and the deployment of software updates to address security vulnerabilities, as well as annual and periodic employee training to educate employees on how to identify and avoid various forms of social engineering.

companyName: Federal Home Loan Bank of Cincinnati


text: • External Threat Landscape Assessment. Our integrated privacy, legal, and security teams are continuously monitoring for any external threat that may impact our operations. Third-party threat intelligence feeds are leveraged to monitor Insulet's digital footprint and activity that may cause brand damage. • Insider Risk Detection. We have targeted tools aimed at detecting insider threats and suspicious data movement. • Cloud and Vulnerability Management. To enhance cloud and data security, we reduce the attack surface by establishing secure defaults, implementing least privilege, and monitoring configurations continuously. As part of vulnerability and overall security posture management, we have a focused cross-functional team that meets regularly to address issues identified by security scans and security configuration checks to maintain hygiene of Insulet's computing devices. • Testing and Audits. Regular penetration testing, incident response tabletop testing, and audits are performed by trusted third-party security consultants. These final reports and gap analysis documents are logged into our risk register as appropriate. • Operating Technology ("OT") Visibility. As a manufacturer of medical devices, OT is a vital component of our business operations. Interconnectedness between OT technology and other business critical information technology infrastructure can create a material cyber risk. Insult deploys segmentation and OT-specific monitoring capabilities to mitigate and monitor this risk. • Vendor Management. Vendors and key partners are subject to Insulet's Vendor Risk assessment process and subsequently monitored by our threat intelligence capability, which tracks our key vendors and suppliers. • Training and Culture. Training, awareness, and incorporating security into Insulet's culture is key to reducing risk around common threats such as phishing. We have an operational information security training program for all employees. In addition to annual trainings, we require and monitor completion of frequent "nanolearning" targeted trainings. These quick trainings provide constant reminders to our employees to be vigilant and give them the tools to recognize and protect against cyber threats. We also conduct phishing simulations to test effectiveness of our training program with the aim of reducing the percentage of employees who click on suspicious emails.

companyName: INSULET CORP

ticker: PODD


text: Role of Management We have established a cross functional Information Security Steering Committee ("ISSC") with executives from our Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at the corporate level and our subsidiaries. The ISSC receives regular reports and updates from Sirius XM Holdings regarding their cybersecurity risk management activities and incidents that have occurred, if any.

companyName: Liberty Media Corp

ticker: FWONA


text: Like other financial institutions, the Company experiences malicious cyber activity on an ongoing basis directed at its websites, computer systems, software, networks and users. This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware, and denial of service attacks. The Company also experiences large volumes of phishing and other forms of social engineering attempted for the purpose of perpetrating fraud. While, to date, malicious cyber activity, cyberattacks and other information security breaches have not had a material adverse impact on the Company, risk to its systems remains significant. See Technology Risk "A successful cyber attack or other computer system breach could significantly harm the Company, its reputation and its customers" within Risk Factors Item 1a.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: The CISO is responsible for performing a thorough examination of any identified or suspected cybersecurity incidents or violations. The CISO will collaborate with the Company's General Counsel and other relevant personnel during this formal review. Documentation detailing the event and an action plan, if required, will be generated by the CISO. Additionally, communication will be promptly established with the Cyber Incident Response Team ("CIRT"), and if deemed necessary, the Audit Committee.

companyName: MBIA INC

ticker: MBI


text: At this time, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. That said, as discussed more fully under "Item 1A. Risk Factors," the sophistication of cyber threats continues to increase, and we cannot assure that our systems and processes will be successful, that we will be able to anticipate or detect all cyberattacks or other breaches, that we will be able to react to cyberattacks or other breaches in a timely manner or that our remediation efforts will be successful.

companyName: Flutter Entertainment plc

ticker: FLUT


text: The Company maintains cybersecurity insurance coverage to help defray any financial losses suffered by the Company in the event of an information security breach. The Company's insurance coverage may not cover all cybersecurity incidents the Company experiences or all losses the Company incurs as a result.

companyName: WOLVERINE WORLD WIDE INC /DE/

ticker: WWW


text: The Committee receives regular reports from management on our cybersecurity posture. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: ARDELYX, INC.

ticker: ARDX


text: Risk Management and Strategy has both on-shore and ship-board systems that are highly dependent on information technology systems. Loss, disruption, or compromise of these systems could significantly impact operations and results. As such, OSG has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our program is based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: OVERSEAS SHIPHOLDING GROUP INC


text: NEE uses third parties to periodically assess the extent to which its cybersecurity risk management protocols align with the U.S. Department of Energy's Cybersecurity Capability Maturity Model standard. Certain functions within NEE are required to comply with certain regulatory standards that are designed to protect against cybersecurity incidents, including the NERC Critical Infrastructure Protection standards. Further, NEE has a cybersecurity training program and a mock phishing program to educate and train employees on potential cybersecurity risks and on privacy and data protection. Given geopolitical events, NEE continues to take steps to protect against cybersecurity threats to its and NEP's critical infrastructure, including communications with personnel to ensure heightened awareness of increased cybersecurity threats worldwide.

companyName: XPLR Infrastructure, LP

ticker: XIFR


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program, as required. Board members may receive presentations on cybersecurity topics from external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Evoke Pharma Inc

ticker: EVOK


text: Cybersecurity risk management is integrated into Adtran's Enterprise Risk Management "ERM" program, in order to provide for continuous oversight and executive engagement. The ERM program undergoes quarterly executive reviews and annual assessments by the Board of Directors, and the Board receives regular briefings on cybersecurity risks, regulatory compliance, and security program updates from management. Key policies include the Information Security Program, which establishes governance principles across facilities, employees, business partners, and customers; the Cybersecurity Framework, which ensures compliance with ISO 27001 and industry standards; employee handbooks outlining security best practices; and the Incident Response Plan, which includes a material impact assessment workflow to support timely regulatory disclosures.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN


text: We design and assess our program based on a combination of the International Organization for Standardization (ISO) 27001, Center for Internet Security (CIS) 18, and the National Institute of Standards and Technology Cybersecurity Framework (NIST). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Commerce.com, Inc.

ticker: CMRC


text: The Company established an Enterprise Risk Management (ERM) Committee that employs the International Organization for Standardization (ISO) risk management standards. Members of the ERM Committee include the Company's CSO, Chief Financial Officer, Chief Network Officer, Director of Safety and Risk Management and the Director of Internal Audit. The committee leverages a proprietary internal risk management tool to maintain a risk register, which systematically identifies, assesses, prioritizes, and manages risks within the enterprise. This structured approach enables us to conduct a formal, periodic risk assessment, ensuring the continuous enhancement of our security posture. In addition to threats, vulnerabilities, impacts and costs, the risk assessment process also identifies the costs and effectiveness of countermeasures and action plans to reduce risk.

companyName: CINCINNATI BELL INC


text: Our management team, including our SVP, Head of Finance and Investor Relations and Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes monitoring the cybersecurity landscape for new risks and best practices, developing and executing cybersecurity strategies, overseeing related governance policies, testing compliance with applicable technical standards, remediating known risks and leading employee training programs.

companyName: IDEAYA Biosciences, Inc.

ticker: IDYA


text: In addition, the Company has made significant investments to fulfill the operational and financial regulatory requirements laid out by the North American Electric Reliability Corporation Critical Infrastructure Protection Standards and Sarbanes-Oxley Act of 2002.

companyName: Alternus Clean Energy, Inc.

ticker: ALCE


text: The CIRT is led by our Vice President and Chief Information Officer and Director of Cybersecurity Risk and Business Continuity. Together, these professionals are responsible for assessing and managing cybersecurity risks and they lead a team of specialized technologists entrusted with ensuring the functionality, continuity, and security of our technology infrastructure and data. Our Vice President and Chief Information Officer is a seasoned IT professional with over 28 years of experience encompassing all facets of IT within the energy industry. His extensive background comprises managing IT service delivery, designing and administering secure solutions, establishing robust IT and Internet of Things infrastructures, and effectively managing technology-related risks. His skill set includes proficiency in threat mitigation, comprehensive risk assessment, and integration of cybersecurity strategies into business operations designed to safeguard critical assets and sensitive data. He reports to our Executive Vice President and Chief Financial Officer. Our Director of Cybersecurity Risk and Business Continuity has over 23 years of experience in the IT field with a majority of that time focused on designing, building and maintaining technology systems. His experience includes implementing security solutions and processes with a focus on adapting to the evolving cybersecurity threat landscape. He is a skilled leader and reports to our Executive Vice President and Chief Financial Officer.

companyName: SM Energy Co

ticker: SM


text: The Audit Committee receives periodic reports from management on our cybersecurity risks and would be notified between such regular updates regarding any significant cybersecurity threat or incident, if applicable. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Atea Pharmaceuticals, Inc.

ticker: AVIR


text: Impact of Risks from Cybersecurity Threats During 2023 and through the date of this Annual Report on Form 10-K, though the Partnership and our service providers may have experienced cybersecurity incidents, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Partnership, including our business strategy, result of operations, or financial condition. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Our IT Security Department aims to monitor and assess these risks to maintain the security and continuity of our operations. Despite the implementation of our cybersecurity programs, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems could have significant consequences to our business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. Please see "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: In an effort to deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with cybersecurity information and training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. Our third-party risk management program is integrated with global sourcing and procurement, and requires vendor risk assessments, incident reporting, and data protection controls. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Apellis Pharmaceuticals, Inc.

ticker: APLS


text: Our board of directors has no specific processes for monitoring cybersecurity within the company. There is no subcommittee specifically for monitoring cybersecurity in the company.

companyName: FOXO TECHNOLOGIES INC.

ticker: FOXO


text: Risks from cybersecurity threats, including any previous cybersecurity events, have not materially affected the Company or its business strategy, results of operations or financial condition. Notwithstanding the comprehensive approach that the Company takes to address cybersecurity risk, the Company may not be successful in preventing or mitigating a future cybersecurity incident that could have a material adverse effect on the Company or its business strategy, results of operations or financial condition.

companyName: Bridgewater Bancshares Inc

ticker: BWB


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Cyber Risk Committee.

companyName: RAMBUS INC

ticker: RMBS


text: The Company assesses its program based on guidance from the National Institute of Standards and Technology ("NIST"). This does not imply that the Company meets any particular technical standards, specifications, or requirements, only that the Company uses the NIST as a guide to help it identify, assess, and manage cybersecurity risks relevant to its business.

companyName: O-I Glass, Inc. /DE/

ticker: OI


text: Continuous endpoint monitoring is ensured through collaboration with a third-party cybersecurity firm. Rapid response protocols are in place for high or critical severity incidents, involving isolation, segmentation and forensic examination by our cybersecurity team. In addition, we have engaged a dedicated third-party threat hunter to assist in identifying Indicators of Compromise.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: Under the oversight of our Board of Directors, and the Audit Committee of the Board, we have developed and maintain an information security program that includes technical, administrative and physical measures designed to safeguard our information and information systems. Cybersecurity risk management is integrated into our broader risk management framework. Our approach includes elements that are proactive and adaptive, using security assessments, employee training and continuous improvement of our cybersecurity infrastructure. We work to align our practices with industry and regulatory standards. Our information security program includes response procedures to be followed in the event of a cybersecurity incident that outline steps to be followed from detection to assessment to notification and recovery, including internal notifications to management, the Audit Committee and the Board, as appropriate. Business continuity and disaster recovery plans are used to prepare for the potential for a disruption to systems or processes we rely on.

companyName: NEW YORK TIMES CO

ticker: NYT


text: Cybersecurity risk management is a major component of our overall risk management systems and processes. We have a cybersecurity program and governance structure designed to identify and manage cybersecurity risks and threats.

companyName: Lazydays Holdings, Inc.

ticker: GORV


text: Multi-Layered Defense and Continuous Monitoring – We work to protect our computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks. We utilize data analytics to detect anomalies and search for cyber threats. We engage third-party consultants or other advisors to assist in assessing, identifying and/or managing cybersecurity threats.

companyName: NORTECH SYSTEMS INC

ticker: NSYS


text: We manage strategic risks, including cybersecurity risk, through our Enterprise Risk Management program which has direct involvement from the board of directors, the audit committee, and senior management. Through this process, we have identified cybersecurity as a risk management priority.

companyName: lululemon athletica inc.

ticker: LULU


text: Our IT Lead is responsible for engaging and overseeing our IT Firm. In consultation with our IT Firm, our IT Lead, Chief Financial Officer and General Counsel integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicate key priorities to relevant personnel, help prepare for cybersecurity incidents, approve cybersecurity processes, and review security assessments and other security-related reports.

companyName: Sensei Biotherapeutics, Inc.

ticker: SNSE


text: Our Head of Cybersecurity is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through our key cybersecurity processes, discussed above, and, together with other lead members of the incident response teams, is responsible for informing senior leadership across the organization about any cybersecurity incidents that may occur. As a result, in addition to the regular updates referenced above, the Audit Committee and the full Board of Directors would also be promptly informed by the CFO and General Counsel of cybersecurity incidents in accordance with our security incident response procedures, as well as provided ongoing updates from lead members of the incident response teams, including the Head of Cybersecurity, regarding any such incidents in accordance with our incident response plan.

companyName: Capri Holdings Ltd

ticker: CPRI


text: Infinera has not experienced a material cybersecurity incident. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to the section titled "Risk Factors" included in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Infinera Corp


text: In the ordinary course of our business, we collect and store sensitive data including, without limitation, our proprietary business information and that of our customers, suppliers and business partners, information with respect to potential ventures and transactions, and personally identifiable information of our employees, customers and business partners. Our business is dependent upon our computer systems, devices, software and networks (operational and information technology) to collect, process and store the data necessary to conduct almost all aspects of our business. We are committed to protecting the confidentiality and integrity of, and access to, our information technology and other business systems, and the personal information of our employees and customers and business data managed, stored and processed on such systems.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: Our cybersecurity program is overseen by the Audit Committee of the Ansys Board of Directors. This oversight is anchored in the Audit Committee's charter, which specifically grants the Audit Committee oversight responsibility on our risks related to cybersecurity, including a review of the state of our cybersecurity program, emerging cybersecurity developments and threats and our strategy to mitigate cybersecurity risks. The Senior Director of Internal Audit and Risk Management, with input from the CISO, reports on the status of the cybersecurity program to the Audit Committee and, periodically or where appropriate, to the Ansys Board of Directors. These reports generally include recent updates and improvements to the cybersecurity program, information on the cybersecurity program's status and intelligence on recent cybersecurity threats, actions we have taken to mitigate such threats and recent material incidents, or potentially material incidents, if any. In addition, the Senior Director of Internal Audit and Risk Management reports to the Audit Committee on the enterprise risk management program, which includes risks associated with cybersecurity.

companyName: ANSYS INC


text: Our Chief Technology Officer and our Chief Information Security Officer ("CISO") lead the Company's cybersecurity function. Our CISO supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CISO has significant global experience in managing and leading IT and cybersecurity teams, with over 20 years of experience in the cybersecurity industry in various positions. Our CISO is a Certified Information Systems Security Professional by the International Information System Security Certification Consortium. Our CISO reports to our Chief Technology Officer, who has over 25 years of software development experience and 15 years of experience in leading software engineering teams in the technology industry, including at Uber.

companyName: Maplebear Inc.

ticker: CART


text: Pursuant to the Audit Committee Charter, the Audit Committee reviews management's assessments of, and plans with respect to, the Company’s cybersecurity and other enterprise risks. The Audit Committee typically receives updates from a Security Committee member quarterly with respect to Information Security team activities.

companyName: QUINSTREET, INC

ticker: QNST


text: The Company has not experienced a material cybersecurity incident during the year ended December 31, 2023. For more information on how material cybersecurity incidents may impact our business, see Part I, Item 1A. "Risk Factors— Other Business Risks—"A cyberattack or threat could harm our business" of this Form 10-K.

companyName: DT Midstream, Inc.

ticker: DTM


text: Management's Role Managing Risk Our Chief Information Security Officer, Chief Executive Officer and Chief Financial Officer play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide cybersecurity briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including as applicable: the current cybersecurity landscape and emerging threats, the status of ongoing cybersecurity initiatives and strategies, incident reports and learnings from any cybersecurity events, and compliance with regulatory requirements and industry practices. In addition to our scheduled meetings, the Audit Committee, our Chief Information Security Officer, Chief Executive Officer and Chief Financial Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates from one another, as appropriate, on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Cytokinetics. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: CYTOKINETICS INC

ticker: CYTK


text: Management is not aware of any material security breaches on its Information Systems and risks from cybersecurity threats have not previously materially affected us. Because certain of our vendors have experienced cyberattacks in the past and the threat and development of cyberattacks is continuous, it is impossible to say with certainty whether the Company's efforts will prevail in a coordinated attack on its Information Systems. We currently do not expect the risks from cybersecurity threats are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition. For additional information about cybersecurity risks, see Item 1A. "Risk Factors."

companyName: NATURAL ALTERNATIVES INTERNATIONAL INC

ticker: NAII


text: Cybersecurity threats have not materially affected, and are not reasonably likely to affect, the Company, including its business strategy, results of operations or financial condition while we are strategically focused on developing an efficient and cost-effective way to produce truly renewable hydrogen using sunlight and any source of water and have minimal commercial operations. The Company is not aware of any material security breach to date. Accordingly, the Company has not incurred any expenses over the last two years relating to information security breaches.

companyName: SUNHYDROGEN, INC.

ticker: HYSR


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. to Board of Directors cybersecurity matters, and strategic risk management decisions, will be escalated to the board of directors.

companyName: Biostax Corp.


text: If our IT department identifies a cybersecurity incident, the IT department assesses such incident and its materiality. If the IT department makes a preliminary determination that a cybersecurity incident may be material, the IT department brings the incident to the attention of the Risk Committee. The Risk Committee then continues its assessment and makes the final determination whether the cybersecurity incident is material. The IT department, the Risk Committee, and any necessary third parties, including managed security service providers, forensic investigators, and internal auditors, collaborate in the response and management with respect to cyber incidents.

companyName: Orion Properties Inc.

ticker: ONL


text: As part of our cybersecurity controls and processes: • we have designed our cybersecurity program based on the National Institute of Security and Technology ("NIST") framework, Generally Accepted Privacy Program ("GAPP") guiding principles, and ISO 27001/2 standards; • our cybersecurity team, led by our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") coordinates with our privacy and information governance team within our legal department to help ensure compliance with applicable regulatory and reporting requirements; • the CIO and CISO undertake an annual review of the cybersecurity strategy and initiatives for Fortive and each of the operating companies, with monthly reviews of performance relative to strategic initiatives with the Chief Executive Officer ("CEO") and the other executive officers; • the CIO and CISO participate in product design efforts with operating company leaders to enhance our product security; • through the compliance training program, we conduct mandatory cybersecurity management, data privacy and incident training for all employees; • we conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to possible threats; • through policy, practice and contract provisions, we require employees, as well as third-party vendors who process data, to treat customer and other personal information and data with care and in compliance with regulations; • we run tabletop exercises conducted by leading third-party cybersecurity experts, with involvement by the broader IT team, legal team, communications team, executive management team, and the Board, to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • we conduct regular network and endpoint monitoring, vulnerability assessments, and penetration testing designed to improve our information systems; • we review and update, and provide training, on cybersecurity incident response plans, business continuity plans, and cyber incident escalation plans, including the involvement of our Disclosure Committee (which includes our CISO as a regular member); • as part of that cyber incident escalation plan, our Disclosure Committee reviews cybersecurity incidents to assess materiality and consider disclosure requirements; • the CISO meets with the information security teams at the operating companies on a monthly basis, or as needed, to review escalated items, compliance with incident response plans, and performance against strategic targets; • the CIO and the CISO meet with the CEOs of our operating segments and the presidents of our operating companies to discuss IT strategies, updates, and initiatives, including those related to cybersecurity; • the CIO and the CISO meet with the Audit Committee on a quarterly basis and the full Board on an annual basis to provide updates on the cybersecurity program, including controls and processes, strategies, achievements, risks, and recent incidents;

companyName: Fortive Corp

ticker: FTV


text: Identifying, assessing, and managing cybersecurity risk is integrated into our overall risk management systems and processes, and we have in place cybersecurity and data privacy training and policies designed to (a) respond to new requirements in global privacy and cybersecurity laws and (b) prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats.

companyName: NVIDIA CORP

ticker: NVDA


text: Our cybersecurity program is under the direction of our Chief Financial Officer ("CFO") and our Chief Technology Officer ("CTO"), who receive reports from our information technology team and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CTO has over 27 years of extensive information technology experience in various roles of increasing importance. His experience includes roles as Director of Technology, Information Technology Manager, Technical Manager, and Systems Analyst. Among his other duties as CTO, he manages our cybersecurity team, which comprises certified and experienced information security professionals, and he has been instrumental in the implementation and monitoring of our various cybersecurity systems and tools.

companyName: Accel Entertainment, Inc.

ticker: ACEL


text: To identify and manage the risks from cybersecurity threats, our cybersecurity program includes various preventative, detection and responsive measures, including without limitation the following: use of monitoring and detection software applications, ongoing employee education and certification about cybersecurity threats, routine security access reviews, and the implementation of physical security measures. As standard practice, we require third-party service providers that may electronically interact with or handle our sensitive information to maintain an effective security management program and to notify us in the event of any known or suspected cyber incident.

companyName: UNIVERSAL DISPLAY CORP \PA\

ticker: OLED


text: Our CIO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Aimco OP L.P.


text: In evaluating the risks identified as a part of the annual assessment process, our information technology team considers the likelihood and severity of the respective risk and the potential impact of the risk, including any potential impact on our customers and our employees. These risks are then prioritized and monitored by the information technology team.

companyName: CALAVO GROWERS INC

ticker: CVGW


text: Cybersecurity risk management is an integral part of our enterprise risk management program. Our cybersecurity program is designed to align with industry best practices and provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers.

companyName: American Well Corp

ticker: AMWL


text: We operate in the medical device industry, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have initiated a risk-based approach designed to identify and assess the cybersecurity threats that could affect our business and information systems. Our strategy is to maintain a high level of risk awareness, identify critical IT assets, regularly update or replace those assets, and systematically perform vulnerability testing, and to promptly remediate deficiencies. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

companyName: NeuroMetrix, Inc.


text: We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. While we have experienced cybersecurity incidents in the past, we believe our current processes, systems and oversight with respect to the management of risks associated with cybersecurity threats are effective. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding the risks we face from cybersecurity threats see "Risk Factors. "

companyName: DOCUSIGN, INC.

ticker: DOCU


text: In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Marpai, Inc.

ticker: MRAI


text: Ellington's technology team assesses the firm's cybersecurity and infrastructure postures regularly with two separate working groups—one group, meeting weekly, focused on IT implementation and one group, meeting bi-weekly, focused on engineering integration. Both groups include senior members of the technology team. These meetings cover a broad range of topics including implementation planning for the deployment of new hardware and software, patch and vulnerability management, considerations for disaster recovery and business continuity, user access controls, data security and more. In such continued monitoring of its cybersecurity posture, Ellington conducts continuous depreciation of obsolete or unsuitable technology, including legacy hardware and software, has a robust patch and vulnerability management process, and has personnel dedicated to the continued monitoring of new developments in threat actors' activities in order to take preventative actions.

companyName: Ellington Financial Inc.

ticker: EFC


text: Since our initial public offering, our sole business activities have been identifying and evaluating suitable initial business combination candidates, including with respect to the Proposed Business Combination, and completing an extension of the period of time in which we must consummate an initial business combination. Therefore, we do not believe that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. To our knowledge, we have not encountered any cybersecurity incidents since our initial public offering. However, see "Item 1A. Risk Factors — Cybersecurity incidents or attacks directed at us could result in information theft, data corruption, operational disruption and/or financial loss" for more information regarding the potential impact of cybersecurity incidents on our business.

companyName: Project Energy Reimagined Acquisition Corp.


text: External managed security services providers and industry-leading security tools continuously monitor our systems and network for cybersecurity threats. Our cybersecurity teams evaluate the escalated threats, and if necessary, take steps to contain and recover from pervasive threats in accordance with our Security Incident Response Plan. The plan includes reporting and escalation procedures to inform the Executive Committee, Audit Committee, and full Board, as appropriate to enable them to carry out their oversight responsibilities, and to ensure timely compliance with applicable reporting rules. Our Business Continuity Management and Disaster Recovery plans include procedures for business recovery and are tested regularly.

companyName: GENESCO INC

ticker: GCO


text: The Audit Committee is central to the Board's oversight of cybersecurity risks. The Audit Committee currently oversees risks relating to cybersecurity, technology, and finance, and in support of this objective has designated an ad hoc committee consisting of both Committee members and non-Committee member directors so as to assure that the Board maintains appropriate expertise to assure the appropriate management of cybersecurity risk. The Audit Committee reports periodically to the Board on the effectiveness of cybersecurity risk management processes and cybersecurity risk trends The Board also receives specific reports from senior management with oversight responsibility for cybersecurity risks within the Company. These reports include cybersecurity and related risks and our exposure to those risks. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with its overall risk management framework.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: We maintain documented information security policies and standards to protect operations, assets, data and services and to defend against, respond to and recover from potential cyberattacks. Our cybersecurity strategy and risk management processes use the National Institute of Standards and Technology governance requirements and cybersecurity framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: AAR CORP

ticker: AIR


text: In 2020, we established the Information Security Steering Committee (the "IS Steering Committee"), a management-level and cross-functional committee, led by our Chief Executive Officer, and comprised of our Chief Compliance Officer, Chief Financial Officer, CISO, Chief Privacy Officer and relevant teams including Information Security, HR, Compliance & Internal Audit and Legal. The IS Steering Committee holds quarterly meetings, during which they review and take action on a wide range of topics, including cybersecurity threat matters such as prevention monitoring, detection mitigation and remediation of cybersecurity incidents.

companyName: MAGNACHIP SEMICONDUCTOR Corp

ticker: MX


text: All employees must complete mandatory, annual comprehensive security awareness training. Our Security organization updates the training to address emerging threats and trends. We also conduct periodic phishing and other social engineering simulations to test our defenses and offer focused phishing training for those who may require additional education.

companyName: Matterport, Inc./DE


text: Markel Ventures has established processes for the Markel Ventures businesses to share information about how they assess, identify, and manage cybersecurity risk, and Markel Ventures shares information on material risks from cybersecurity incidents with Markel Group management, as appropriate. Each Markel Ventures business has a board that meets regularly. Material matters regarding cybersecurity risk management and cybersecurity incidents are discussed at these meetings. In addition, Markel Ventures management regularly meets with the businesses to discuss their risk identification, assessment, and management approach. These discussions include how the business assesses, identifies, and manages key risks, including cybersecurity risks.

companyName: MARKEL GROUP INC.

ticker: MKL


text: Our management team, including our CTO and Senior Director of Information Security, are responsible for assessing and managing our material risks from cybersecurity threats, and our Chief Financial Officer and General Counsel are responsible for associated materiality assessments. Our CTO and cybersecurity team have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Their experience includes decades spent managing the security programs of publicly traded corporations, formal cybersecurity education programs from accredited academic institutions, and numerous security certifications such as CISSP, CCSP, CySA+ and AWS Architect & Security Specializations.

companyName: Warby Parker Inc.

ticker: WRBY


text: The Company has not experienced any material losses relating to cybersecurity threats or incidents to date. We are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.

companyName: TFS Financial CORP

ticker: TFSL


text: The EROC receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: The Company has established an information security program that uses a risk-based methodology to ensure the confidentiality, integrity, and availability of its information. The Board of Directors and the Enterprise Risk Management Committee set enterprise risk strategy and make risk-informed decisions, which includes assessment and response to cybersecurity risk. The Board has appointed an Information Security Officer ("ISO") to oversee the program. The program utilizes a combination of automated tools, manual processes, and third-party assessments to identify and assess potential cybersecurity threats. The program is supported by an organization structure that reflects support from across the business. Program objectives and results are regularly reported to the Enterprise Risk Management Committee, Audit Committee, and Board of Directors.

companyName: MidWestOne Financial Group, Inc.

ticker: MOFG


text: Our information systems are continuously monitored for security threats and anomalies, and our incident response plan and processes are built to enable us to identify, contain, eradicate, and recover from security incidents in a coordinated fashion, helping maintain the function and security of our IT assets, information resources, and business operations. We have formed relationships with various third-party experts and advisors to provide support in the event of a cybersecurity incident. Additionally, we have established various elements of risk management to mitigate costs associated with cybersecurity incidents.

companyName: TreeHouse Foods, Inc.

ticker: THS


text: Describe whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the registrant, including its business strategy, results of operations, or financial condition and if so, how.

companyName: Energy & Water Development Corp

ticker: EAWD


text: We believe our information technology team to be well-qualified in this area. These qualifications include professional experience in the field and recent participation in IT and cybersecurity programs organized by leading institutions with expertise in the field.

companyName: MUELLER INDUSTRIES INC

ticker: MLI


text: Cybersecurity Incident Impact We have experienced, and expect to continue to experience, cyber threats and incidents. As previously disclosed, on July 23, 2023, we experienced a cybersecurity incident affecting certain of our data and IT systems. As a result of the cybersecurity incident, we incurred $14.3 million of costs in connection with this event. Following a forensic investigation in connection with the incident, we concluded there was no material impact to our financial results for the year ended 2023.

companyName: SOMNIGROUP INTERNATIONAL INC.

ticker: SGI


text: Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. We believe we have allocated adequate resources related to our cybersecurity risk management processes and have designated our Chief Financial Officer with the responsibility of managing the cybersecurity risk assessment and mitigation part of our overall risk management program, we provide required training to employees in high risk areas on cybersecurity and have distributed standard operating procedures to all employees subsequent to this filing. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item computer systems, or those of our CROs or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs," "Our proprietary information, or that of our customers, suppliers and business partners, may be lost or we may suffer security breaches," and "Failure of our information technology systems could significantly disrupt the operation of our business.

companyName: Shuttle Pharmaceuticals Holdings, Inc.

ticker: SHPH


text: The CTO holds a Master of Business Administration from the University of Kentucky/University of Louisville's joint executive program and has an extensive background in information security, risk management, and incident response with over twenty years of varying information technology roles with increasing responsibility at both private and public companies. The CTO is supported by a dedicated team of cybersecurity professionals, each bringing diverse expertise in areas such as network security, data protection, and threat intelligence.

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: We have implemented an information security program that is informed by, and incorporates elements of, industry standards and frameworks, including those issued by NIST (National Institute of Standards and Technology), ISO (International Organization for Standardization), and CIS (Center for Internet Security). Our security program is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats.

companyName: BridgeBio Pharma, Inc.

ticker: BBIO


text: To mitigate cybersecurity risks we strive to continually assess and improve our processes and procedures. We engage with industry-leading managed security service providers to supplement our efforts in identifying, assessing, preventing, and responding to cybersecurity threats. We are working to align our information technology operations and information security processes to the National Institute of Standards and Technology's framework. We have adopted a cloud-first strategy which is a foundational element to our overall cybersecurity posture. For essential systems, we utilize SaaS-based software partners who annually conduct Statement on Standards for Attestation Engagements.

companyName: Comstock Holding Companies, Inc.

ticker: CHCI


text: Third-Party Vendors We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers, suppliers, and other vendors. We use a variety of inputs in such risk assessments, including information supplied by vendors and in some cases attestations from objective, reputable, and licensed assessors. Where appropriate, our contracts with vendors require agreement and adherence to commercially reasonable security, confidentiality, and privacy contractual terms. Vendors are subject to security risk assessments at the time of onboarding and are thereafter periodically monitored and reassessed depending on risk level and our cybersecurity practices and in light of evolving cybersecurity standards and legal and regulatory requirements.

companyName: Premier, Inc.


text: The Audit Committee of the Board of Directors oversees our information security program, which includes oversight of the cybersecurity program and management of cybersecurity risks. The Audit Committee receives at least semi-annual updates from the CISO, which typically address our cybersecurity strategy, initiatives, key security metrics, business response plans and the evolving cyber threat landscape and a detailed threat assessment relating to information technology risks.

companyName: ESTEE LAUDER COMPANIES INC

ticker: EL


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected our business strategy, results of operations, or financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. Refer to Item 1A – " Our internal computer systems, or those used by our CROs or other contractors or consultants, may fail or suffer security breaches " and " We are dependent on information technology, systems, infrastructure and data," which are incorporated by reference into this Item 1C. As cybersecurity threats become more sophisticated and coordinated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures as we pursue our business strategies.

companyName: IOVANCE BIOTHERAPEUTICS, INC.

ticker: IOVA


text: Our cybersecurity oversight includes our internal control environment, cybersecurity standards, benchmarks, and internal governance committees. Annually, we assess, either internally or by an independent third-party, against multiple cybersecurity maturity models. We also leverage other industry standards and benchmarks, such as National Institute of Standards and Technology (NIST) standards, and Cybersecurity and Infrastructure Security Agency (CISA) best practices to inform our oversight strategy. The governance committee functions to ensure adherence and accountability to these standards and deploy appropriate resources to keep pace with the shifting cybersecurity threat landscape.

companyName: ONE Gas, Inc.

ticker: OGS


text: e.conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; f.conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data;

companyName: Inhibrx, Inc.


text: Enterprise risk management (ERM) at Spire oversees significant risks to the Company's ability to successfully execute on strategy and achieve corporate objectives. Spire's ERM is based on a structured, comprehensive process that leverages ISO 31000:2018, adopted and customized to the Company's needs, utilizing an ongoing process of risk identification, evaluation, treatment, integration and monitoring. ERM helps assess priorities and facilitate decision-making for resource allocation as it relates to risk management. Two risks prioritized by our Enterprise Risk Oversight Committee related to cybersecurity are cyber threats and vendor management. Additionally, the ERM process is structured to integrate with operational levels, where risk is managed, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 utilized by the Company's Information Security function for managing cybersecurity.

companyName: SPIRE INC

ticker: SR


text: Moreover, our commitment to data security extends beyond industry standards through the implementation of advanced access controls. We have developed a sophisticated access control system, referred to as "dumb access controls," which limits access to only specific vendors within a predefined range of costs. This system operates through a faceless entry point with a unique 4FA process, ensuring that access to sensitive banking or application systems is strictly controlled and virtually nonexistent for unauthorized entities. These comprehensive security measures not only protect our business transactional data but also uphold the integrity and confidentiality of our systems and information assets.

companyName: Strive, Inc.

ticker: ASST


text: Our board of directors has oversight of our ERM Program, the Enterprise Security Program, and Information Security areas which include risks from cybersecurity threats and has approved specific controls for the mitigation, monitoring and reporting associated with those risks. The Risk Oversight Committee and Operations Committee of the board of directors receive regular reporting (at least quarterly) on the risks and are responsible for overseeing the risks, including receiving Enterprise Security Program updates from the information security officer (ISO), Information Technology status updates, and reviewing enterprise risk analysis and status information, and annually reviews the Business Resiliency Management Policy and Program.

companyName: Federal Home Loan Bank of Topeka


text: The full Board provides oversight of the cybersecurity program while the Audit Committee of the Board predominantly oversees risk, including data security and oversight of cybersecurity risks, providing regular updates to the full Board. The CSO is actively engaged in discussions with the Board regarding the identification, assessment, and mitigation of cybersecurity risks to ensure that appropriate resources are dedicated to managing such risks and addressing any potential adverse effects, and provides periodic reports to our Board and Audit Committee, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: Clear Secure, Inc.

ticker: YOU


text: Our CSO holds an undergraduate degree in Computer Science and has served in various information technology and information security roles, including serving as the CSO for two public companies as well as various leadership roles in two medium sized private companies over the last 30 years.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: We engage in regular monitoring and assessments of our technology infrastructure utilizing our internal staff and third-party specialist. Our independent auditors periodically review our processes, systems and controls related to our information security program to ensure they are operating effectively.

companyName: First Savings Financial Group, Inc.

ticker: FSFG


text: The processes and controls related to data security are regularly tested by the IS department and Internal Audit. Additional internal security assessments may be performed at the request of the CISO, CIO, the Internal Auditor, Management or our Board. Audit and assessment results are presented to the Audit Committee of the Board, and to the IT Steering Committee.

companyName: CSB Bancorp, Inc.

ticker: CSBB


text: To date, cybersecurity risks, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "Our business and operations would suffer in the event of system failures or cyber security attacks" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: SL GREEN REALTY CORP

ticker: SLG


text: We have certain processes for the identification, assessment, and mitigation of cybersecurity risks which are incorporated into our overall risk management processes in coordination with our information technology function. Such processes include physical, procedural and technical safeguards, and routine review of our policies and procedures to identify risks and improve our practices. We conduct cybersecurity training and testing for all of our employees covering timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, and mobile security, and we educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We engage third-party consultants to enhance our cybersecurity oversight and conduct penetration testing and vulnerability assessment s. Further, we consider the cybersecurity practices of our third-party service providers, including through a general security assessment and contractual requirements, as appropriate, before engaging them in order to help protect us from any related vulnerabilities.

companyName: Werewolf Therapeutics, Inc.

ticker: HOWL


text: T he Security Governance Committee meets regularly and receives prompt and periodic information, as needed or applicable pursuant to Bank policies and plans, from the Information Security Department which in turn provides periodic, regular and prompt reporting to senior management. Reports include topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, project development and implementation, any cybersecurity incidents or threats occurred, as well risk assessment, management and monitoring updates, as applicable and as needed.

companyName: Federal Home Loan Bank of Atlanta


text: The Audit Committee is responsible for the oversight of risks associated with cybersecurity threats. The Audit Committee charter provides that the Committee is responsible for considering the effectiveness of the Company's internal control system, including information technology security and control. The Director of IT reports significant cybersecurity events to our Vice President of Administration or Chief Financial Officer, who then reports such events to our Audit Committee.

companyName: Biofrontera Inc.

ticker: BFRI


text: Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents, and is responsible for oversight and management of our cybersecurity risk management program. Our management team receives briefings from our internal Information Security team and the Disclosure Committee whenever applicable. Such briefings include information regarding threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our information technology environment. Our management team also provides quarterly cybersecurity risk management program updates, to the Board of Directors or to the Audit Committee, in alternating quarters.

companyName: CADENCE DESIGN SYSTEMS INC

ticker: CDNS


text: We believe the members of our management team involved in assessing and managing material cybersecurity risks have the experience needed to perform their duties, including through education, certification, work experience or a combination thereof. For example, our Vice President–Information Technology has approximately 26 years of IT experience in various roles, the majority of which has been at publicly-reporting real estate companies. In addition, the other members of our management team identified above have from 15 years to 30 years of work experience managing risks or control environments, including experience at the Company and other professional businesses, or, as third-party advisors, helping businesses manage risks or control environments.

companyName: STAG Industrial, Inc.

ticker: STAG


text: Despite our efforts to prevent cybersecurity threats and incidents, our systems may be affected by damage or interruption resulting from, among other causes, cyber attacks, security breaches, power outages, system failures or malware (including ransomware and other programs that operate with malicious intent). Disruptions to these systems may impair our ability to conduct business and have a material adverse effect on our business, results of operations and financial condition. Despite the security measures we have in place, our facilities and systems and those of third parties we rely on or do business with, may be vulnerable to cyber attacks, security breaches, malware (including ransomware and other programs that operate with malicious intent), power outages, system failures, acts of vandalism, human or technical errors, or other similar events or disruptions. Any such event involving the misappropriation, loss or other unauthorized disclosure of information, whether impacting us or third parties we rely on or do business with, could result in losses, damage our reputation or relationships with customers and suppliers, expose us to the risks of litigation, regulatory action and liability, disrupt our operations and have a material adverse effect on our business, results of operations and financial condition.

companyName: SHERWIN WILLIAMS CO

ticker: SHW


text: JFG employs a process designed to periodically assess the cybersecurity risks associated with the engagement of third-party vendors and service providers. This assessment is conducted on the basis of, among other factors, the types of products or services provided and the extent and type of data accessed or processed by the third party.

companyName: Senior Credit Investments, LLC


text: Management leverages the collective expertise of the Company's information security function which reports to the Chief Financial Officer through the Company's Chief Information Security Officer ("CISO"). The CISO has served in this position for the Company since 2017, holds various relevant credentials including CISSP (Certified Information Systems Security Professional), and has extensive cybersecurity experience having served in information technology roles for over 35 years and cybersecurity leadership roles for 15 years. The CISO reports to the Risk Committee quarterly on information security matters, including, among other things, the Company's cyber risks and threats, the status of projects to further strengthen the Company's information security systems, assessments of the Company's security program and the emerging regulatory and threat landscape. The CISO also briefs the full Board of Directors on cybersecurity matters at least annually. As described above, management informs the Risk Committee about prevention, detection, mitigation and remediation of cybersecurity incidents quarterly and monitors such matters continuously. The Risk Committee reviews and discusses with management the quality and effectiveness of the Company's efforts to mitigate such risks and reports such findings to the Board of Directors.

companyName: OPENLANE, Inc.

ticker: OPLN


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We maintain a strategic plan to protect our information and to manage and mitigate emerging cybersecurity threats. Our cybersecurity team, led by our Chief Information Security Officer ("CISO"), oversees our cybersecurity efforts on a day-to-day basis. Our cybersecurity team, in partnership with third parties, designs, implements and operates our data security and cybersecurity programs, risk assessments, monitoring procedures, and training programs for our associates.

companyName: Ferguson Enterprises Inc. /DE/

ticker: FERG


text: Unauthorized parties have attempted, and we expect that they will continue to attempt, to gain access to our systems and facilities, as well as those of our third-party vendors, through various means, such as hacking, social engineering, phishing, and fraud. However, such incidents have not materially affected, nor are they reasonably likely to materially affect, our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors – Risks Related to Our Bitcoin Acquisition Strategy and Holdings – If we or our third-party service providers experience a security breach or cyberattack and unauthorized parties obtain access to our bitcoin, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our bitcoin and our financial condition and results of operations could be materially adversely affected" and "Item 1A. Risk Factors – Risks Related to Our Operations – If we or our third-party service providers experience a disruption due to a cybersecurity attack or security breach and unauthorized parties obtain access to our customers', prospects', vendors', or channel partners' data, our data, our networks or other systems, or the cloud environments we manage, our offerings may be perceived as not being secure, our reputation may be harmed, demand for our offerings may be reduced, our operations may be disrupted, we may incur significant legal and financial liabilities, and our business could be materially adversely affected."

companyName: Strategy Inc

ticker: MSTR