text: Our Chief Information Security Officer ("CISO") regularly engages independent third parties to assess the performance of our cybersecurity risk management systems and procedures and to help test and identify cybersecurity risks to the Company. Annually, we engage an independent third-party to perform a comprehensive review of our cybersecurity programs, with the aim of ensuring alignment with the current version of the CSF. In addition, we engage several other third parties at regular intervals for targeted assessments of specific cybersecurity risk management systems, tools, vendors and processes. Among other things, tests include simulations of communications shared with affected stakeholders on security events and identification of vulnerabilities. These third-party audits and assessments are used by management to review, update and improve our cybersecurity risk management systems and identify vulnerabilities. Results and recommendations are reported to our CISO, who reports to our General Counsel. Material findings are presented to the Global Risk Committee ("GRC"), Audit Committee and the full Board as discussed below.

companyName: Lazard, Inc.

ticker: LAZ


text: We engage a variety of third-party service providers to process and store data, including certain customer information, some of which may include personally identifiable information. We also depend on third-party service providers to host many of the systems and infrastructure used to provide our products and services. A limited number of third-party services support essential functions of our business, including the use of cloud-based technology. We rely on these third parties to implement their own cybersecurity programs and cannot ensure their effectiveness. To manage cybersecurity risks arising from our use of third parties, we have a third-party service provider management program which includes the use of security questionnaires, review of statements of work and related information security addenda, procuring results of audits and compliance reviews and obtaining overviews of network infrastructure, among others. Depending on the nature of the services provided, the sensitivity of the data at issue and the identity of the third-party, our third-party service provider management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: ZILLOW GROUP, INC.

ticker: ZG

secItem: Item 1C


text: In recent years, cybersecurity attacks have increased on businesses as cyber criminals seek to gain access to sensitive information and use it for their personal or financial gain. We continuously seek to implement advanced technologies to strengthen our infrastructure, monitor for threats, and evaluate our capability to respond to incidents in order to minimize the potential impact to our systems, data, and operations.

companyName: INDEPENDENCE REALTY TRUST, INC.

ticker: IRT


text: Refer to Part I, Item 1A. "Risk Factors" of this 2024 Annual Report on Form 10-K for further information about the Company's overall ERM process.

companyName: BADGER METER INC

ticker: BMI


text: Our Vice President, Global Head of Information Technology and Chief Information Security Officer and our Security Steering Committee (which includes our Chief Financial Officer, Chief Product and Technology Officer, Senior Vice President of Engineering, and General Counsel and Chief Compliance Officer), identify, assess and manage the Company's cybersecurity threats and risks (the "Cybersecurity Function"). Various individuals that are part of the Cybersecurity Function help identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: manual tools, internal and/or external audits, automated tools, conducting threat assessments for internal and external threats, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting vulnerability assessments to identify vulnerabilities, conducting scans of the threat environment, use of external intelligence feeds, evaluating our and our industry's risk profile, third-party-conducted red/blue team testing and tabletop incident response exercises, and evaluating threats reported to us.

companyName: CS Disco, Inc.

ticker: LAW


text: PPG has continued to invest in cybersecurity to evolve and improve its program. PPG regularly assesses and measures itself against industry practices to identify opportunities to improve its people, processes and technology used to identify, prevent, detect, respond and recover from cybersecurity incidents. When such improvements are identified and validated as appropriate in PPG's business context, they are incorporated in the roadmap for implementation.

companyName: PPG INDUSTRIES INC

ticker: PPG


text: In addition, we undertake ongoing cyber risk assessments as part of our efforts to detect, evaluate and respond to potential cybersecurity threats, including regular testing by our internal information security team. We require all employees and contractors to participate in cybersecurity training designed to enhance their understanding of cyber threats and their ability to identify and escalate potential incidents. Our vulnerability management program is designed to identify, assess, and remediate cybersecurity threats in our systems, such as through penetration testing.

companyName: AVIAT NETWORKS, INC.

ticker: AVNW


text: We engage and consult with external assessors and consultants, on a regular basis, to evaluate our cybersecurity processes, including to anticipate future threats and trends, and their impact on the Company's risk environment. We have implemented a robust information security internal and external audit program that operates throughout the year. Our environment is tested annually against internationally recognized standards as well as locally (domestic) applicable standards. Findings and opportunities for improvement that result from such external audits are remediated to help our security posture remain current. Prior to and/or periodically throughout and engagement, we work closely with our clients and vendors on various security assessments that test our processes compliance with contractual requirements. We have also engaged a third-party vendor to conduct regular employee trainings on cyber and information security, among other topics.

companyName: KLDiscovery Inc.


text: QNB Bank's information technology resources are managed by the Information Technology Department, which is responsible for identifying, assessing, and managing material risks from cybersecurity threats. The present COTO, who reports directly to the current President and Chief Executive Officer ("CEO"), has been with QNB Bank for over eight years and has over twenty-five years of experience in banking technology and operations. He has an MBA in Management Information Systems and is a current Certified Information Systems Security Professional. QNB's IT Director and ISO report directly to the COTO. The Information Technology Department is managed by the IT Director. The present IT Director has been employed by QNB Bank in the information technology area for ten years has been in the technology industry for over fifteen years and holds numerous technology certifications. QNB's ISO, whose responsibilities include security relating to QNB's information systems, is a Certified Information Systems Security Professional and a Certified Information Security Manager. The ISO, among other duties, supervises internal employee training relating to cybersecurity risks, conducts access reviews relating to QNB's information systems, and monitors implemented checks and balances relating to access to information. Information relating to cybersecurity risks and cybersecurity incidents, if any, is reported by the COTO and the ISO and to both the Information Technology Committee and the Information Security Committees. Additionally, cyber security incidents are reported to QNB's Board of Directors by the COTO no less than quarterly.

companyName: QNB CORP.

ticker: QNBC


text: Management has implemented a program ("Program"), which is part of our overall Enterprise Risk Management system, focused on the assessment, identification, and management of material risks associated with cybersecurity threats. The Program was developed and is managed by our Vice President of Information Security and Privacy (CISSP, CISM and CISA) with oversight from the Chief Information Officer. Both leaders collectively have over 60 years of technology risk and cybersecurity work experience supporting multiple life science organizations. The Program is also closely aligned with the Legal and Global Compliance organizations to oversee adherence with legal, regulatory and contractual requirements from an information security and data privacy perspective.

companyName: TELEFLEX INC

ticker: TFX


text: As part of our cybersecurity risk management framework, we have implemented comprehensive Corporate Incident Response Plans (IRPs) and other policies and procedures designed to ensure the assessment, identification, and management of material risks from cybersecurity threats, and to facilitate timely disclosure of material cybersecurity incidents in accordance with SEC rules. Our policies provide for cybersecurity awareness training for employees and engagement in due diligence processes in accordance with industry best practices for third-party vendors, including those handling critical services or sensitive data on our behalf. Our policies also provide for regular, senior management-led table-top exercises simulating cyberattack scenarios to ensure preparedness and response agility. We undertake an annual review of our policies to help ensure their effectiveness and relevance in light of evolving cybersecurity threats. Additionally, we maintain cyber insurance to help cover costs associated with the occurrence of certain cybersecurity events. We do not currently engage any other third parties as part of our cybersecurity risk management framework, but we do use third party services and products in the ordinary course with respect to certain common cybersecurity threats.

companyName: Strategy Inc

ticker: MSTR


text: The Board and Audit Committee maintain responsibility for enterprise risk oversight related to cybersecurity, privacy, and data protection and security. The Audit Committee has delegated the primary responsibility for oversight of compliance and risk management efforts and processes related to these matters to the Cybersecurity Subcommittee, which was established in 2023 and is comprised of independent directors. The Cybersecurity Subcommittee oversees management's efforts and processes to identify, assess, manage, and monitor significant cybersecurity and privacy risks and regulatory developments in this area. Our cybersecurity and privacy leaders meet with the Cybersecurity Subcommittee to discuss the Company's cybersecurity and data protection risk exposures, including the steps management has taken to monitor and manage such exposures and their potential impact on the Company's business, operations, and reputation. The Cybersecurity Subcommittee reports periodically on these matters to the Audit Committee and Board.

companyName: Booking Holdings Inc.

ticker: BKNG


text: Occidental has developed a robust cybersecurity program which is reviewed by senior leadership including its Chief Information Officer (CIO) and other stakeholders as part of its standard general IT controls. Business network and ICS cybersecurity risks are handled by separate and dedicated Occidental teams and are incorporated into Occidental's enterprise risk management program.

companyName: OCCIDENTAL PETROLEUM CORP /DE/

ticker: OXYWS


text: We rely on the Investment Adviser's enterprise-wide cybersecurity program to protect our information, including due oversight of the cybersecurity programs of our key service providers and processes for the assessment, identification, and management of material risks from cybersecurity threats, including those associated with the use of third-party service providers. The Investment Adviser considers such cybersecurity threats as part of its broader risk management framework, and its cybersecurity program is designed to, among other things, protect us, insofar as is practicable, from the hazards of cybersecurity threats and vulnerabilities in accordance with applicable legal requirements and guidance. The Investment Adviser collaborates with third-party subject-matter experts, as necessary, to identify and assess material cybersecurity threat risks and evaluate and test its cybersecurity protections, including through continuous network and endpoint monitoring, employee anti-phishing training, vulnerability assessments, and penetration testing to inform the Investment Adviser's risk identification and assessment. The Investment Adviser also performs due diligence reviews on third parties that have access to our systems or data, or facilities that house such systems or data, and continually monitors cybersecurity threat risks identified through such diligence.

companyName: SLR Investment Corp.

ticker: SLRC


text: We draw on the knowledge and insight of external cybersecurity experts and vendors, and internally employ dedicated, certified, cybersecurity staff, such as but not limited to, CISSP, CISM, CISA, CSSP or other equivalent certifications, that leverage an array of third-party tools to secure OneMedNet information infrastructure and protect systems and information from unauthorized access. Non-technical safeguards also play an important role in our cybersecurity program. We provide various training programs and tools to employees so they can avoid risky practices and help us promptly identify potential or actual issues. We also have global incident response procedures, global service tools to log incidents and issues for investigation, and an ethics line to report concerns and follow-up on matters already reported.

companyName: OneMedNet Corp

ticker: ONMD


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to our Cybersecurity Incident Management Team, which consists of a representative from our IT Firm, IT Lead, Chief Financial Officer and General Counsel. In addition, our incident response policy includes reporting to our disclosure committee and audit committee of the board of directors for certain cybersecurity incidents.

companyName: Sensei Biotherapeutics, Inc.

ticker: SNSE


text: Murphy utilizes industry leading technologies that focus on continuous monitoring and analytics built on machine learning and artificial intelligence to safeguard against sophisticated cyberattacks. Deployed technologies include next generation firewalls, advanced endpoint and email protection, multi-factor authentication and Managed Detection and Response. In addition to the monitoring and detection processes for its own IT systems, Murphy also has processes in place to identify cybersecurity threats associated with third party service providers and partners; these processes include industry information sharing groups, cybersecurity notification services, vendor risk assessments, and ongoing collaboration with federal agencies.

companyName: MURPHY OIL CORP

ticker: MUR


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding significant cybersecurity incidents.

companyName: Lyra Therapeutics, Inc.

ticker: LYRA


text: Response to Security Vulnerabilities In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: • Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches. • Ensuring that changes to security configurations are documented, approved, and tested when possible. • Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. • Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. • Conducting subsequent penetration testing and vulnerability assessments, as warranted. • Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the company.

companyName: Central Plains Bancshares, Inc.

ticker: CPBI


text: We have devised a multi-faceted approach to assess, identify, protect, detect, respond to and recover from cybersecurity threats using the NIST CSF 2.0 Framework. We have implemented numerous threat management tools and processes, and developed disaster recovery and business continuity plans that are tested and updated periodically. We strive to stay abreast of cybersecurity threats through integrated threat intelligence feeds, industry and federal threat notices, and participation in healthcare industry intelligence sharing. We also regularly conduct table-top exercises, which serve to simulate cybersecurity incidents to practice our response and identify gaps. We routinely perform security risk assessments using internal and external services, including internal and external penetration testing.

companyName: Ardent Health, Inc.

ticker: ARDT


text: In the normal course of business, we may collect and store personal information and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, patient information, sensitive third-party information and employee information. To protect this information, our existing cybersecurity policies require continuous monitoring and detection programs, network security precautions, encryption of critical data and in-depth security assessments of vendors. We maintain various protections designed to safeguard against cyberattacks, including firewalls and virus detection software. We have established and regularly test our disaster recovery plan, and we protect against business interruption by backing up our major systems. In addition, we periodically scan our environment for any vulnerabilities, perform penetration testing and engage third parties to assess the effectiveness of our data security practices. Our information technology (" IT ") team is responsible for these ongoing monitoring and detection activities.

companyName: SS Innovations International, Inc.

ticker: SSII


text: We leverage well-known and established third parties as industry partners to support our key business processes and utilize the services of reputable external advisory firms for running important functions such as cybersecurity assessments and technical security management activities, including network security management.

companyName: Applied Therapeutics, Inc.

ticker: APLT


text: We have a multi-pronged approach to assess, identify, and manage material risks from cybersecurity threats. This approach includes system testing and patching, continuous monitoring, end-user training and awareness, multi-layered security, redundancy mechanisms, encryption, and internal audits and assessments. Assessment of cybersecurity risk is part of our overall enterprise risk management ("ERM") process, which is reviewed by the Audit Committee of our Board of Directors, along with our strategies for managing our cybersecurity risks.

companyName: MGP INGREDIENTS INC

ticker: MGPI


text: As of the date of this Report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect our Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. See Item 1A. "Risk Factors – Risks Related to Cybersecurity, Data Security, and Privacy, Information Technology and Intellectual Property" for additional information about the risks to our business associated with a breach or compromise to our IT systems.

companyName: HF Sinclair Corp

ticker: DINO


text: Our IT department maintains internal and external resources and is led by our IT Manager and assisted by our Risk Assessment/IT Compliance & Enterprise Manager. These two individuals have a combined 40+ years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. The IT department is responsible for the information security of the organization and for the oversight of all cybersecurity infrastructure and programs. The department provides regular reports to senior management and other relevant teams on various cybersecurity threats, assessments, and findings.

companyName: Bluerock Homes Trust, Inc.

ticker: BHM


text: Our cybersecurity organization assesses and manages cybersecurity risk through technical, physical and administrative controls, including implementing cybersecurity policies, procedures and strategies, with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while increasing our system resilience in an effort to minimize business impact should an incident occur. The underlying controls of the cybersecurity risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework. In addition, we maintain a Data Incident Response Program, which is designed to identify, assess, manage and report significant data incidents, including those reasonably likely to affect our business strategy, results of operations or financial condition. The Data Incident Response Program outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas, senior management, and the Company's disclosure committee or a sub-committee thereof as appropriate. The disclosure committee or a sub-committee thereof will consider the materiality of an incident elevated by the Data Incident Response Program, inform the Board and other key stakeholders as appropriate, and determine the Company's reporting obligation on a timely basis.

companyName: Kenvue Inc.

ticker: KVUE


text: Management (including our VP of Internal Audit) reports quarterly to the Audit Committee on information security. These presentations address a wide range of topics, including trends in cyber threats and the status of initiatives intended to bolster our security systems and the cyber readiness of our personnel.

companyName: CELESTICA INC

ticker: CLS


text: The cybersecurity committee receives periodic notices (written and verbal) from the Cybersecurity Team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented that are intended to address them. The cybersecurity committee also receives quarterly reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: NETGEAR, INC.

ticker: NTGR


text: In addition, the Company maintains specific policies and practices to mitigate third party security risks, including a process for evaluating the security controls of vendors and service providers who exchange data with the Company or have access to or integrate with the Company's systems. At the same time, the Company's control over the security posture of third parties is limited and there can be no assurance that any vendor or service provider of the Company will not experience a compromise or failure in the information assets under its control.

companyName: BLACKBERRY Ltd

ticker: BB


text: Our cybersecurity team implements various security processes, standard operating procedures and tools that aid in the prevention, detection, investigation, response and remediation of vulnerabilities and risks. These include, but are not limited to, endpoint and cloud threat detection and response systems, network application and API security services, cloud security posture management solutions, enterprise data loss prevention ("DLP") and governance services, cloud-native security scanners and source code analysis tooling. The cybersecurity team is responsible for the continuous monitoring, reporting and response to threats and vulnerabilities discovered through the deployment and operation of these tools. If any deficiencies relating to our internal controls over financial reporting are discovered, the Senior Director of Cybersecurity is required to report them to our internal audit team.

companyName: PAR TECHNOLOGY CORP

ticker: PAR


text: Our Chief Information & Security Officer has over 30 years of experience in the cybersecurity industry, including, prior to joining Alight in 2021, as the SVP, Chief Information Security Officer at a multinational health insurance and health services company in the Fortune 100, and as head of cybersecurity for a U.S.-based financial services company in the Fortune 500, as well as for a federal banking institution and for a professional services company in the Fortune 500 specializing in information technology services. Our Chief Information & Security Officer reports directly to the Chief Technology Officer and meets regularly with other members of senior management and the Audit Committee.

companyName: Alight, Inc. / Delaware

ticker: ALIT


text: Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Fundamentally, our information security program is tasked with developing pragmatic strategies for preserving the confidentiality, integrity and availability of Company and customer information. Pursuant to this approach, we have implemented controls to prevent, detect and mitigate cybersecurity risks posed by third parties. We use various tools and methodologies, including a written incident response plan and cybersecurity insurance, to manage and mitigate cybersecurity risk. Those tools and methodologies are evaluated on a regular and continuing basis. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. Through both short-term "game day" events and more prolonged campaigns, red team programming is designed to continuously stress test the fortitude of our information security systems and assist in identifying areas of potential vulnerability. Based on the results of these simulated exercises, we aim to harden any identified exposure points and adjust our security processes to ensure dynamism and responsiveness. Along with our in-house cybersecurity capabilities, we also periodically engage third parties to assist with detecting and responding to cybersecurity risks. Third parties may be engaged to assist with procedures including red and blue team training exercises and penetration testing. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. Amongst other controls, we maintain policies and practices that monitor, regulate and limit remote access of our information systems.

companyName: Core Scientific, Inc./tx

ticker: CORZ


text: Related to Cybersecurity Risks Management is responsible for identifying and assessing material risks for the business on an ongoing basis, including in relation to cybersecurity. As part of this process, our IRT is tasked with implementing and maintaining our cybersecurity programs, including establishing processes to ensure that potential cybersecurity risk exposures are monitored and putting in place appropriate mitigation measures. Our Chief Financial and Business Officer oversees our information technology department which monitors the prevention, detection, mitigation, and remediation of cyber incidents, if any, and reports all potential incidents and an initial assessment of such incident to the IRT. Our Chief Financial and Business Officer has over 7 years of experience with overseeing risk, compliance, and information technology functions.

companyName: Nkarta, Inc.

ticker: NKTX


text: Cybersecurity Program Overview The Investment Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The program is aligned with the NIST CSF 2.0 framework, providing a structured approach to identify, protect against, detect, respond to, and recover from cybersecurity threats. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. In addition, the Investment Adviser actively monitors the current threat landscape to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: WhiteHorse Finance, Inc.

ticker: WHF


text: Board Oversight of Cybersecurity Risks Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from our Response Team regarding the overall state of our Advisor's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.

companyName: Horizon Technology Finance Corp

ticker: HRZN


text: Our IT Director has served in various roles in technology leadership for more than 20 years, including cybersecurity. With an undergraduate degree in Information Systems, an MBA, and certification as a Certified Information Systems Security Professional (CISSP) from ISC2, the IT Director plays a key role in managing risks at our company. This includes risks arising from cybersecurity threats, drawing on extensive experience gained from similar companies and leadership positions across the technology sector. Although the Company does not have both a Chief Technology Officer or a Vice President of Security, the IT Director's expertise ensures robust risk management practices are in place. Our Chief Executive Officer, Chief Financial Officer and IT Director each hold undergraduate and/or graduate degrees in their respective fields, and each has experience managing risks at our Company and at similar companies including risks arising from cybersecurity threats.

companyName: AMTECH SYSTEMS INC

ticker: ASYS


text: Role Managing Risk the management team, the responsibility for assessing and managing cybersecurity risk falls under the purview of the CFO. To that extent, the Company leverages his extensive experience and specialized skills. This collaboration significantly bolsters our overall cybersecurity stance, creating a well-rounded and robust defense against emerging threats.

companyName: Vertical Data Inc.

ticker: VDTA


text: The Corporation works closely with its internal auditors to assess, identify, and manage cybersecurity risks. In addition, the Corporation engages with third party cybersecurity specialists to provide an independent assessment of the Corporation's cybersecurity programs and to prepare a 3-year plan to maintain compliance and operational excellence. Management periodically reviews the 3-year plan and modifies it in response to changes in the threat landscape or otherwise as needed. Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Corporation, including its business strategy, results of operations or financial condition. However, there can be no assurance that the Corporation's security efforts and measures will be effective or that attempted security incidents or disruptions would not be successful or damaging. In addition, although the Corporation maintains cybersecurity insurance to provide some coverage for certain risks arising out of data and network breaches, there can be no assurance that the Corporation' cybersecurity insurance coverage will be sufficient in the event of a cyber attack. See "Item 1A. Risk Factors" above for more information.

companyName: CNB FINANCIAL CORP/PA

ticker: CCNE


text: The Audit Committee of the Board of Directors receives quarterly reports from the Senior Director of IT concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented (or plans to implement) to address them. The Audit Committee of the Board of Directors also may request various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: CHIMERIX INC


text: Our cybersecurity program is designed to safeguard the confidentiality, integrity and availability of information assets by monitoring the cyber threat landscape, internal threats and technological changes and through the development of controls to mitigate risk to the organization and our customers. While cybersecurity is a dynamic and constantly evolving field, we strive to minimize the occurrence and impact of unauthorized access, disruption to our information systems and are committed to staying informed about emerging threats, adopting industry best practices, and integrating feedback from our assessment and incidents. We deploy and manage both preventive and detective controls and processes to mitigate cybersecurity threats, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems. We also deploy and manage preventive and detective controls and processes related to the mitigation of risks from our use of third-party service providers.

companyName: CANTALOUPE, INC.

ticker: CTLP


text: The Company's Network and Cloud Administration is led by the CDO and is also responsible for managing security infrastructure and deploying, configuring, and managing various security solutions, tools and products to assist in safeguarding the Company's information system infrastructure and operations.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We design and assess our program based on the Center for Internet Security (CIS) control objectives and benchmarks. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS objectives and benchmarks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: COGENT COMMUNICATIONS HOLDINGS, INC.

ticker: CCOI


text: As a publicly-traded financial institution, we are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations and reputation, including, but not limited to, cyber-attacks against us or our critical third-party service providers. These cyber-attackers can attempt to gain unauthorized access to our digital systems for purposes including, but not limited to: misappropriation of company assets, accessing Company confidential or sensitive customer non-public information, corrupting data, causing operational disruptions, or as part of a ransom demand for payment. As described below, we believe we have appropriate risk management processes, governance policies, standards, and procedures, a system of internal controls designed to address and mitigate these risks, and experienced internal resources to execute our information security and cybersecurity risk management programs.

companyName: Capital Bancorp Inc

ticker: CBNK


text: Overview the protect connection with the services we provide. The Company realizes that cyber incidents can have financial, reputational, and operational impacts that can significantly adversely affect our customers, capital, and earnings. Therefore, we integrate cybersecurity processes throughout the Company as part of our enterprise-wide governance process. Regulatory agencies are the cybersecurity are the the cybersecurity the Federal Financial Institutions Examination Council ("FFIEC"). framework offers a set of guidelines financial institutions manage and mitigate cybersecurity risks effectively. It focuses on ensuring the confidentiality, of sensitive information and systems. Compliance Department the Bank cybersecurity and the Risk Committee of our Board of Directors.

companyName: USCB FINANCIAL HOLDINGS, INC.

ticker: USCB


text: If and when the Company completes a merger or other acquisition, the board of directors and management will assess the risks of cybersecurity threats to its business and adopt processes for assessing, identifying and managing risks from cybersecurity threats as warranted.

companyName: Unite Acquisition 2 Corp.


text: The Company's Board of Directors has assigned oversight of cybersecurity risk to the Audit Committee, as outlined in the Committee's charter. Updates on the cybersecurity risk program are provided at each Audit Committee meeting. Additionally, the Company's senior management engages with the Audit Committee on a regular basis to provide updates on our cybersecurity risk program.

companyName: Core Natural Resources, Inc.

ticker: CNR


text: Risks from cybersecurity threats did not materially affect our results of operations or financial condition during the period covered by this filing.

companyName: Kenvue Inc.

ticker: KVUE


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities. The Board of Directors receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually.

companyName: INTRUSION INC

ticker: INTZ


text: We prioritize the protection of our data assets, the private data of our employees, customers, and vendors, and personal information. To assess, identify, and manage the risks of cybersecurity threats to our information systems and the associated costs, we maintain a robust cybersecurity program that is integrated into the Company's overall Enterprise Risk Management strategy. We understand that threats from hackers and other cyber criminals continues to adapt and become more sophisticated, and so must our response to these threats.

companyName: Mistras Group, Inc.

ticker: MG


text: The information security program is under the responsibility of the Chief Information Officer (CIO). The CIO is responsible for leading and implementing, with a cross functional team, our cybersecurity strategy, standards, and risk management policies and procedures.

companyName: NCR Voyix Corp

ticker: VYX


text: Our Board's role in risk oversight is consistent with our leadership structure, with management having day-to-day responsibility for assessing and managing our risk exposure and our Board actively overseeing the management of our risks both at the Board and Committee level. The Board conducts its risk oversight by receiving reports from each of the Committees and our executive officers regarding our risk identification, risk management, and risk mitigation strategies with respect to areas of potential material risk, including cybersecurity risk. The Board has delegated to the Audit Committee of the Board primary responsibility for overseeing risks from cybersecurity threats. Our Associate Vice President of IT & Facilities briefs the Audit Committee on our cybersecurity risk management program on a quarterly basis, using risk assessment reports from our third-party cybersecurity vendor. The briefing includes discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation.

companyName: Ocugen, Inc.

ticker: OCGN


text: Overseeing Third-party Risk We rely on the third parties for various business functions. In certain circumstances, our third-party services providers have access to some of our information systems and data, depending on the nature of their engagements with us, and we rely on such third parties for the continuous operation of our business operations. Because we are aware of the risks associated with third-party service providers, we conduct vendor diligence and security assessments of third-party providers before engagement and maintain ongoing monitoring to oversee compliance with our cybersecurity standards.

companyName: MACOM Technology Solutions Holdings, Inc.

ticker: MTSI


text: Review and provide oversight on the Company's disaster recovery, business continuity, and business resiliency capabilities, including escalation protocols, relating to its customer-facing products and services and internal-use IT systems; Review annually the appropriateness and adequacy of the Company's cyber-insurance coverage;

companyName: Cohen & Co Inc.

ticker: COHN


text: The Company leverages a variety of industry frameworks and regulatory guidance to develop and maintain its information systems and cybersecurity program, including but not limited to Interagency Guidelines Establishing Information Security Standards, Federal Financial Institutions Examination Council ("FFIEC") Information Technology Examination Handbook (with particular emphasis on the FFIEC's Information Security and Business Continuity Management Handbooks), FFIEC Cybersecurity Assessment Tool, Gramm-Leach-Bliley Act ("GLBA") 501(b), and the Center for Internet Security ("CIS") Critical Controls Framework. In addition, the program leverages certain, third-party benchmarking, audits, and third-party threat intelligence sources to facilitate and enhance the effectiveness of the program.

companyName: Esquire Financial Holdings, Inc.

ticker: ESQ


text: Cybersecurity is incorporated into our business strategy as cybersecurity risks may have a negative impact on our business as outlined within "Item 1A, Risk Factors." Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and security incidents of our and our third-party vendors' data and systems. For more information, please see "Item 1A, Risk Factors."

companyName: Toast, Inc.

ticker: TOST


text: We depend on information systems and technology in substantially all aspects of our business, including running our manufacturing operations and communicating among our employees, suppliers and customers. Such uses of information systems and technology give rise to cybersecurity risks, including risk of system disruption, security breach, ransomware, theft, espionage and inadvertent release of information. We have a risk-based cybersecurity program, dedicated to protecting our data and information technology systems. These cybersecurity threats and related risks make it imperative that we remain vigilant and apprised of developments in the information security field, and we expend considerable resources on cybersecurity. With Board of Directors and Audit Committee oversight, we assess and manage the material risks associated with cybersecurity as part of our risk management process.

companyName: METHODE ELECTRONICS INC

ticker: MEI


text: Material Cybersecurity Threat Risk To date, the Company has not experienced any known cybersecurity incidents that have materially affected its business strategy, results of operations or financial condition. However, we can provide no assurance that all of our security measures will be effective. For additional information regarding cybersecurity threats, please refer to Item 1, Business – Supervision and Regulation – Privacy and Cybersecurity and Item 1A, Risk Factors – Risks Related to Our Operations.

companyName: EAST WEST BANCORP INC

ticker: EWBC


text: We have global policies covering IT security standards, annual training modules for employees. We also train our employees on cybersecurity through phishing simulations.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: PGE has a threat intelligence function to stay abreast of emerging cybersecurity threats. The Company's threat identification process begins with the development of an inventory of critical enterprise processes and critical assets, which allows the Company to prioritize focus in the event of a threat. PGE's Security Operations Center detects unauthorized entities and actions on the networks and in the physical environment, including personnel activity. Processes are tested regularly, through reviews, audits, and periodic exercises.

companyName: PORTLAND GENERAL ELECTRIC CO /OR/

ticker: POR


text: Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk.

companyName: byNordic Acquisition Corp

ticker: BYNO


text: We maintain a cybersecurity risk management program to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our cybersecurity risk management program incorporates various mechanisms to detect and monitor unusual network activity, as well as containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business and have processes to assess those issues for potential cybersecurity impact or risk.

companyName: TECOGEN INC.

ticker: TGEN


text: Part I Item 1A, 1B, and 1C including key questions to be addressed, critical decision points, and sources of key information to support decision-making. Senior management and the Emergency Incident Response Team periodically review and drill on the plan.

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: We rely on information systems and networks as well as various other technologies to conduct and support our business. We have implemented security protocols, controls, and systems with the intent of maintaining the physical and electronic security of our operations and protecting our and our counterparties' confidential information and information related to identifiable individuals against unauthorized access. Some of these systems and networks are managed, hosted, and provided by third parties, and as a result, are also sources of cybersecurity risk. Third party cybersecurity incidents could affect a provider's ability to deliver a product or service to the Company or result in lost or compromised information of the Company or its customers. We have implemented measures intended to secure our information systems and networks and prevent unauthorized access to or loss of sensitive data. Where third parties house financially significant or sensitive data, the Company obtains and reviews attest reports covering cyber-related controls at these third parties, designs and implements complementary user entity controls, maintains open lines of communication for cyber incident notifications, and has contractual safeguards in place in the event a cyber incident occurs.

companyName: WARRIOR MET COAL, INC.

ticker: HCC


text: In summary, while we maintain confidence in the effectiveness of our cybersecurity measures, we acknowledge the dynamic nature of the cybersecurity landscape and remain vigilant in our efforts to adapt and respond to emerging threats. Our commitment to cybersecurity extends beyond mere compliance; it is a fundamental aspect of our corporate ethos and a cornerstone of our efforts to safeguard the interests of our shareholders, customers, and stakeholders.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: The Company has developed and implemented processes to assess, identify, and manage material risks from cybersecurity threats as part of its overall enterprise risk management system. Its cybersecurity processes include security monitoring and threat hunting through a third-party managed vendor and mandatory, company-wide employee training. The processes also extend to oversight and identification of risks associated with vendors and customers if their computer systems interface with the Company's information systems. Upon detection of a potentially material cybersecurity incident, the Company initiates its cyber incident procedure to investigate, contain, and remediate the incident.

companyName: TWIN DISC INC

ticker: TWIN


text: In an effort to mitigate cyber intrusions, the Company has implemented a cybersecurity program intended to protect and preserve the integrity, confidentiality and reliability of data and systems. Cybersecurity risks are a key component of the Company's overall risk management, is integrated into other corporate processes and goes beyond the Company to certain vendors or suppliers. The Company has instituted certain cybersecurity requirements, interacted with various external organizations including its state regulator, and participated in proprietary briefings by industry experts to maintain an awareness of current cybersecurity threats and vulnerabilities.

companyName: RGC RESOURCES INC

ticker: RGCO


text: Company maintains a governance structure to address cybersecurity risk, which involves a dedicated Information Security Team (the "Information Security Team"), an Information Security Governance Board (the " Information Security Governance Board "), the Audit Committee of the Board and the Board.

companyName: Inspired Entertainment, Inc.

ticker: INSE


text: We have designated a Network and Security Engineer, who reports to the Director of IT & Security, to assess and manage our material cybersecurity risks and threats. In this role, the Network and Security Engineer installs and manages our corporate firewalls, Enterprise Infrastructure engineering, and network analysis, but also supports our incident response and vulnerability management efforts. With over 10 years of experience in cybersecurity, the Engineer ensures our controls remain effective and that any emerging threats are promptly addressed.

companyName: Blaize Holdings, Inc.

ticker: BZAI


text: In addition, the Cybersecurity Program provides for the notification and escalation of identified cybersecurity threats and incidents, with different severity thresholds triggering notification to different recipient groups, including, as appropriate, to members of our management, the Audit Committee and to our full Board of Directors. In the event we or Angel Oak Capital, including our Manager, experiences a cybersecurity incident that materially affects, or is reasonably likely to materially affect, us, members of our management and of our Manager would review the incident with the Audit Committee to consider whether and to what extent disclosure would be required under Item 1.05 of Form 8-K.

companyName: Angel Oak Mortgage REIT, Inc.

ticker: AOMR


text: Risk-based controls for information systems and information on NeurAxis' networks: We seek to maintain an information technology infrastructure that implements physical, administrative and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity and availability of our information systems and information stored on NeurAxis' networks, including customer information, personal information, PHI/PII, intellectual property and proprietary information. NeurAxis added physical safeguards in the form of biometric entry systems to access server rooms and 24/7 surveillance at both NeurAxis locations.

companyName: Neuraxis, INC

ticker: NRXS


text: We continue to evaluate and enhance our systems, controls, and processes where possible, including in response to actual or perceived threats specific to us or experienced by other companies.

companyName: SHOREPOWER TECHNOLOGIES INC.

ticker: SPEV


text: We employ a risk management strategy for the assessment, identification and management of material risks stemming from cybersecurity threats. Our methodologies involve a systematic evaluation of potential threats, vulnerabilities, and their potential impacts on our organization's operations, data, and systems. Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, and our IT environment; • The use of external service providers to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees and senior management through the use of third-party providers for regular mandatory trainings; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • We design and assess our program using the National Institute Cybersecurity Framework ("NIST CSF") as a set of guiding principles.

companyName: NewLake Capital Partners, Inc.

ticker: NLCP


text: We regularly engage with consultants to review our cybersecurity program to help identify areas for continued focus, improvement and compliance. Our processes also address cybersecurity risks associated with third-party service providers, including those with access to our non-public or restricted data, including client data. Third-party risks are also included within our ERM program and are actively reported to the Audit and Governance Committees. Our Third-Party Risk Management Program comprises a defined process to identify, assess, and mitigate risks by our third-party suppliers and service providers, specifically including cybersecurity and privacy risks.

companyName: CRAWFORD & CO

ticker: CRD-A


text: We have an Enterprise Cybersecurity Management Review Group (Enterprise Cybersecurity MRG), which functions as a steering committee to provide oversight and strategic direction for the enterprise cybersecurity program. The Enterprise Cybersecurity MRG is comprised of senior leaders with cross-functional experience and responsibilities. This MRG meets regularly, at least four times per year, with our Chief Information Security Officer to review the cybersecurity program and related risks. The MRG receives updates on the status of key cybersecurity initiatives and is responsible for our response to material cybersecurity incidents.

companyName: CUMMINS INC

ticker: CMI


text: We acknowledge the potential cybersecurity risks inherent in our relationships with third-parties. Accordingly, we have implemented a third-party risk management program to identify and oversee such risks. This program relies on key elements including risk assessment, due diligence, contractual provisions and ongoing monitoring to identify and mitigate impacts from high-risk third-parties and of specific risks. We use security risk assessment questionnaire tools to identify high-risk third-parties, allowing us to effectively assess and mitigate potential security vulnerabilities.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: • Incident Response and Recovery Planning – We have established and maintain a cybersecurity incident response procedure plan that addresses our response to cybersecurity incidents and recovery from such incidents, and such plan is tested and evaluated periodically. • Communication, Coordination and Disclosure – We utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, risk management and other key business functions, as well as the members of the Audit Committee of the Board of Directors, in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. We have established an Incident Response Committee to quickly organize and execute an effective, productive, timely and compliance-conscious response to cybersecurity threats and incidents, as well as coordinate among the cross-functional groups. • Governance – The Board of Directors' oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with our experienced Chief Information Security Officer (CISO), the Incident Response Committee, which is chaired by our SVP Administration, and other members of management.

companyName: GREENBRIER COMPANIES INC

ticker: GBX


text: We provide and maintain data protection and cybersecurity training to limit the exposure of our business to security events based on soft attacks against our employees.

companyName: HIGH WIRE NETWORKS, INC.

ticker: HWNI


text: The Audit Committee of our Board of Directors provides Board-level oversight of risks from cybersecurity threats. In addition to providing periodic reports, at least annually the Senior Director of Cybersecurity and the Senior Vice President-Information Technology meet with the Audit Committee regarding cybersecurity risks and assessments and related Company policies and initiatives. The Audit Committee and management have adopted a policy that categorizes cybersecurity incidents and sets out incident escalation procedures to the full Board of Directors.

companyName: AVALONBAY COMMUNITIES INC

ticker: AVB


text: Our board of directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. The audit committee of the Company's board of directors provides structured oversight of the Company's risk management program, which focuses on the most significant short-, intermediate-, and long-term risks the Company faces. The Company has an information security compliance committee (the "Committee") that consists of the members of the Company's compliance committee, which reports to the board of directors, and at least three members of Company management. The Committee is responsible for overseeing the development and upkeep of written policies and procedures aimed at safeguarding the Company's information systems and the nonpublic information stored within them. In addition, the Committee plays a crucial role in the governance of the cybersecurity risk management process. This involves collaborating with third-party industry experts and the Company's internal audit team to conduct risk assessments of the Company's information security program (the "Program"). The assessments encompass an evaluation of the Company's adherence to the Program, including the elements of the Program that are dictated by relevant laws, regulations, and the Company's information security manual. Furthermore, the Company conducts periodic cybersecurity assessments and preparedness analyses, supervised by our designated Chief Information Security Officer ("CISO").

companyName: CREDIT ACCEPTANCE CORP

ticker: CACC


text: The Board is responsible for the oversight of cybersecurity risk management and is composed of members with diverse expertise in risk management, technology, and finance, thereby equipping them to manage and prevent cybersecurity risks effectively.

companyName: Rhinebeck Bancorp, Inc.

ticker: RBKB


text: We have developed an information security program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our information security program is managed by our SVP, Chief Security Officer ("CSO"), whose team (the "CSO Office") is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, technologies, and processes. Our CSO's primary responsibility includes assessing, monitoring, and managing our cybersecurity risks. Her background includes extensive experience as an enterprise CSO, with over 24 years of experience in the field of cybersecurity. In partnership with our Chief Information Officer ("CIO") who leads our Governance Risk and Compliance ("GRC") function, the CSO Office oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee security training program.

companyName: JFrog Ltd

ticker: FROG


text: We have implemented a number of security measures designed to protect our systems and data, including firewalls, antivirus and malware detection tools, patches, log monitors, and routine back-ups,. In addition, we have continued our efforts to migrate our platforms to cloud-based computing, which is designed to further strengthen our security posture.

companyName: NEXGEL, INC.

ticker: NXGL


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function through the Audit Committee.

companyName: Blend Labs, Inc.

ticker: BLND


text: The board of trustees is acutely aware of the critical nature of managing risks associated with cybersecurity threats and oversees the Company's cybersecurity risk management activities.

companyName: National Storage Affiliates Trust

ticker: NSA


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from senior management, including leaders from our Information Security and Legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity, and data privacy incidents (if any) and status on key information security initiatives.

companyName: Paragon 28, Inc.


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we:

companyName: 5&2 Studios, Inc.


text: Marcus O. Pegues has served as Director of IT since 2021. He works with the Company's internal information technology department and external partners to monitor and improve our cybersecurity capabilities. Mr. Pegues has guided, in coordination with other management staff, strategic technology, risk mitigation, process improvement initiatives, and digital initiatives. His experience in technology and cybersecurity, spans a career of more than 15 years. He earned his Master of Science in Information Technology with Specialization in Project Management from Colorado Technical University and his Bachelor of Science in Business Management with Specialization in Information Technology from Colorado Technical University.

companyName: TEJON RANCH CO

ticker: TRC


text: We have processes in place that we believe are designed to allow our information security team and management to be informed of and monitor the prevention, detection, mitigation, and remediation of cybersecurity risks. These processes include establishing a formal incident response team, penetration testing, system vulnerability scanning, phishing simulations, tabletop exercises, employee security and compliance training, disaster recovery planning, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning.

companyName: INSPERITY, INC.

ticker: NSP


text: The Company also has a Risk Assessment Committee composed of selected members of senior management. Member(s) of the information security team are members of this Risk Assessment Committee (which occur at least quarterly) to address cybersecurity risks and discuss cybersecurity threats to the Company. Member(s) of the information security team have the opportunity to present at the Risk Assessment Committee meetings and raise issues and concerns regarding cybersecurity. The minutes of Risk Assessment Committee meetings are provided to the Board and senior management discusses with the Board the matters addressed at the applicable Risk Assessment Committee meeting.

companyName: SANFILIPPO JOHN B & SON INC

ticker: JBSS


text: Our IT Manager has been designated as our Chief Information Security Officer ("CISO"), who is responsible for identifying, assessing and managing our risks from cybersecurity threats. The CISO has been with the Company for over five years and has many years of experience in technology. The CISO is supported by our outside IT consulting firm and its cybersecurity team that is staffed with personnel experienced in cyber security, security operations and incident management.

companyName: STRATA Skin Sciences, Inc.

ticker: SSKN


text: The Board of Directors also receives periodic updates from management and the Audit Committee on cybersecurity risks. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Executive Officer. Management regularly updates the Audit Committee on our cybersecurity programs, which includes cybersecurity risks and mitigation strategies, vulnerability management, and on-going cybersecurity projects.

companyName: FRANKLIN WIRELESS CORP

ticker: FKWL


text: We utilize an internal global incident management team, comprised of executive and senior management-level personnel, that is responsible for oversight of our business resiliency and cybersecurity incident response programs. Within our information security organization, our cybersecurity incident response team works closely with the business resiliency team across business continuity, disaster recovery, and crisis management functions to plan, prepare, and practice response to simulated cybersecurity incident scenarios for response readiness. In the event of a cybersecurity incident, our incident response team would assess whether to engage the support of law enforcement or other third parties. In addition to our cybersecurity incident response team, we have retainers with leading incident response organizations to augment response activities, if needed. We also conduct one or more annual cybersecurity incident response tabletop exercises with senior management and third-party experts to test our incident response plan and enhance our readiness for a potential cybersecurity incident.

companyName: Unum Group

ticker: UNM


text: The Audit Committee of the Board is responsible for oversight of risk management related to cybersecurity and policies and procedures related to the protection of Company proprietary and customer information and compliance with data privacy requirements. The Audit Committee receives quarterly updates from our Chief Information Officer. Reports may address evolving trends in cybersecurity, major threat developments, and technologies, solutions, policies, and procedures we use to detect, prevent, mitigate and remediate threats, respond to incidents and crises, and educate employees on information security importance and requirements. The Audit Committee has regular opportunities to suggest adjustments to the Company's cybersecurity practices. It regularly reports to the Board on fulfillment of its responsibilities, which include cybersecurity risk management oversight.

companyName: WERNER ENTERPRISES INC

ticker: WERN


text: Our information security organization comprises internal and external resources designed to identify, protect, detect, mitigate, resolve, and recover from various threats and attacks by malicious actors. We leverage 24x7x365 monitoring tools and services to address the confidentiality, integrity, and availability of Silvercrest assets and data. Regular internal and third-party reviews are performed on our processes and technologies to validate the effectiveness of our privacy and data security controls and safeguards. We monitor industry best practices and developments in data privacy and security, including increased scrutiny of third-party service providers with access to sensitive Silvercrest data. We have implemented and maintain a written proprietary security incident response plan, with defined roles and responsibilities that address notification obligations and incident response procedures to follow in the event of a data security breach. We are dedicated to business continuity and resiliency, and have documented strategies, policies, and procedures in place to protect employee, business, and client data in the event of an emergency or natural disaster. Our information security risk management processes are integrated into our broader risk management program.

companyName: Silvercrest Asset Management Group Inc.

ticker: SAMG


text: The Company's CIO possesses a wealth of information technology expertise and has served in various technology leadership roles across multiple industries. They are responsible for all technology systems, services, and solutions. The cybersecurity function reports directly into the office of the CIO.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: For a description of the risks from cybersecurity threats that may materially affect us, please, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "Cybersecurity risks and the failure to maintain the confidentiality, integrity, and availability of our computer hardware, software, data and internet applications and related tools and functions, or those of third parties with whom we work, could result in damage to our reputation and/or subject us to costs, fines or lawsuits."

companyName: Silence Therapeutics plc

ticker: SLN


text: Employees undergo cybersecurity training during orientation. Employees and board members receive annual training to promote cybersecurity awareness. All employees are required to abide by our cybersecurity and data protection policies. To date, the Company has not experienced a material cybersecurity incident.

companyName: Embassy Bancorp, Inc.

ticker: EMYB


text: Management is responsible for our company's day-to-day risk management activities. Our cybersecurity program is led by our Chief Information Officer, who is responsible for assessing and managing cybersecurity risks. He has 25 years of experience in both military and corporate leadership roles, including 12 years of experience in CIO-level leadership roles, including consulting with major firms, covering technology and security operations responsibility.

companyName: Orthofix Medical Inc.

ticker: OFIX


text: We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats. We have designed and implemented an Access Control Policy. The policy and supporting procedures encompass all information systems that are owned, operated, maintained, and controlled by the Company and all other information systems, both internally and externally, that interact with these systems. Our cybersecurity program and policies is a collaborative effort, requiring commitment from all personnel, including management, internal employees and users of information systems, along with vendors, contractors, and other relevant third parties.

companyName: Cycurion, Inc.

ticker: CYCU


text: The SVP, Chief Privacy Officer, dedicated Cyber Security Analyst, and other key members of the information technology team actively monitor threats to the information technology environment. They work with a third party to provide additional 24/7 monitoring of cyber threats. These internal and external cybersecurity teams are empowered to contain network access through various application controls. Structural protections are also in place to mitigate risks of end point failures, and provide for continuity of operations.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO


text: Our Chief Technology Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from our third-party IT service provider.

companyName: Verde Clean Fuels, Inc.

ticker: VGAS


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our clinical trials and product, product candidates, and technology ("Information Systems and Data").

companyName: Y-mAbs Therapeutics, Inc.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from security incidents were immaterial. As a result, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, our results of operations and financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. See "Risk Factors — Risks Related to Privacy and Security." As cybersecurity threats become more frequent, sophisticated and coordinated, it is reasonably likely that we will be required to expend greater resources as we pursue our strategy of continuously modifying and enhancing our protective measures while developing and commercializing products that incorporate our CGM technologies and integrate with the insulin delivery systems or data platforms of our partners. The technology integration and cloud-based depository platforms we continue to focus on can make us more vulnerable to cybersecurity threats, thereby making our pursuit of such strategies more costly.

companyName: DEXCOM INC

ticker: DXCM


text: Each CSSC meets quarterly and reports to the Company's senior management team, including the Corporate Compliance Officer, on progress towards specific cybersecurity objectives. A strong partnership exists between our information technology, enterprise security, internal audit and legal and compliance functions so that identified issues are addressed in a timely manner and incidents are reported to the appropriate regulatory bodies as required.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: Understanding the potential risks associated with third-party service providers, we shall implemented stringent processes to oversee and manage these concerns. We shall conduct thorough security assessments before engaging with any third-party provider and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This involves quarterly assessments by our management and continuous evaluations by our security engineers. This approach is designed to mitigate the risks of data breaches or other security incidents originating from third-party sources. We have no t encountered cybersecurity issues that have significantly impacted our operational performance or financial status.

companyName: JOCOM HOLDINGS CORP.

ticker: JOCM


text: Our systems regularly face attacks that aim to interrupt and delay our operations or obtain information from our systems. Any major disruption or nefarious access, to our systems or a third-party's systems, could lead to disclosure or destruction of data, including employee, customer and corporate information, which may expose us to business, regulatory, litigation and reputation risk and could negatively affect our business and results of operations. As of the date of this Annual Report on Form 10-K, we have not encountered incidents from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial position. Refer to "Item 1A. Risk factors" in this Annual Report on Form 10-K, including "Significant disruptions of information technology systems, breaches of data security, or compromised data could materially adversely affect our business" for additional discussion about cybersecurity-related risks.

companyName: ARKO Corp.

ticker: ARKO


text: Our incident response plan coordinates the activities that we take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: 5&2 Studios, Inc.


text: Our risk management and mitigation approach includes the adoption of security controls and adaptive ongoing threat analysis. Our policies and our baseline security controls incorporate robust security infrastructure, risk-based controls and multi- layered defense systems. We have 16 System and Organization Controls Type 2, or SOC 2, certifications with respect to our information security and infrastructure. Our adaptive analysis monitors the threat landscape relevant to Nasdaq, our vendors and financial industry peers, and threats arising from geopolitical events. As the external threat landscape evolves, our information security controls are regularly evaluated, updated and enhanced to help protect against emerging risks. Additionally, we conduct extensive cybersecurity assessments of our acquired entities, both prior to acquisition and following completion of the transaction, to understand potential threats and mitigate any potential security gaps, as well as to ensure compliance with our security infrastructure and access management practices and policies.

companyName: NASDAQ, INC.

ticker: NDAQ


text: Our Board has overall oversight responsibility for our risk management and is briefed periodically on cybersecurity risk management and any material cybersecurity incidents by our Chief Information Officer, or CIO, and General Counsel. The Board is responsible for ensuring that management has processes in place designed to (i) identify and evaluate cybersecurity risks to which the company is exposed and (ii) manage cybersecurity risks and mitigate cybersecurity incidents.

companyName: American Well Corp

ticker: AMWL


text: Additionally, as part of our processes to manage risks related to a breach in our information systems, management requires employees to take cybersecurity trainings and shares regular awareness updates regarding cybersecurity threats. Our Cybersecurity Team regularly tests employees throughout the year to assess the effectiveness of our cybersecurity training. We also conduct penetration testing of our network and undertake cybersecurity assessments to improve our risk mitigation and assist in the determination of a potential material impact caused by a cybersecurity incident.

companyName: MERCURY SYSTEMS INC

ticker: MRCY


text: We confront substantial cybersecurity risks driven by various factors. These risks are rooted in the wide range of systems we must safeguard against cyberattacks, further exacerbated by the complexity and technical sophistication of our products and systems. Additionally, our reliance on third-party products, services, and components adds complexity to our risk landscape.

companyName: OppFi Inc.

ticker: OPFI


text: Our Company, through the leadership of the CISO, utilizes a variety of security governance and operational processes to manage our secure use of technology, including, but not limited to, the management of risks from insiders, third-parties, security controls, vulnerabilities, threats, and incident response.

companyName: SecureWorks Corp


text: Reporting to Board of Directors The SVP IT plays a pivotal role in informing the Audit Committee on cybersecurity-related risks. The Audit Committee holds quarterly meetings and the SVP IT provides periodic reports, on at least a quarterly basis, to the Audit Committee.

companyName: TANGER PROPERTIES LTD PARTNERSHIP /NC/


text: We also monitor and test our safeguards and train all our employees on cybersecurity safeguards related to our information technology systems. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic cybersecurity trainings and tests. Further, we are focused on building and maintaining a positive cybersecurity culture through a combination of trainings, educational tools, videos, and other cybersecurity awareness initiatives. Our security training incorporates awareness of cyber threats (including malware, ransomware, and social engineering attacks), password hygiene, the importance of multifactor authentication and our incident reporting process. In addition to the assessment of internal cybersecurity risks, we have implemented processes to oversee, identify and monitor material risks from cybersecurity threats relating to potential compromises of sensitive information at our third-party business partners where relevant and we reevaluate these risks periodically. These processes include vetting of certain service providers for security, reliability, and availability; execution of a Business Associate Agreement with relevant providers for compliant management, storage, or processing of PHI if necessary; and confirmation by each service provider that its SOC-2 reports, or equivalent reports, are current and available, where applicable. In the event a service provider does not have a current and available SOC-2 or equivalent report, we review the service provider's cybersecurity risk management and advise relevant business stakeholders of any significant identified risks.

companyName: ACCURAY INC

ticker: ARAY


text: The Company's Director of IT is responsible for assessing, identifying, and managing the risks from cybersecurity threats. Our Director of IT has over 15 years of experience in information security positions and holds Master's degree in computer information systems. We also have constituted a cross-functional Cybersecurity Committee, comprised of Chairman, CFO, Management of Business Operations and Human Resources, which meets regularly to review enterprise-wide cybersecurity matters.

companyName: FGI Industries Ltd.

ticker: FGI


text: We have developed and implemented a cybersecurity risk management program that is intended to enable us to assess, identify, and manage risk associated with cybersecurity threats. Our program is based on the Cybersecurity Framework promulgated by the National Institute of Standards and Technology and other applicable industry standards, and includes the following key elements: • identification and assessment of cybersecurity threats based on internal and external assessments and monitoring, information from internal stakeholders, and external publications and resources such as those made available by the United States Cybersecurity and Infrastructure Security Agency; • technical and organizational safeguards designed to protect against identified threats, including documented policies and procedures, technical controls, and employee education and awareness; • processes to detect the occurrence of cybersecurity events, and maintenance and regular testing of incident response and recovery and business continuity plans and processes; and • a third-party risk management process to manage cybersecurity risks associated with our service providers, suppliers, and vendors. The program is designed to foster a culture of cybersecurity risk management across the Company.

companyName: NUCOR CORP

ticker: NUE


text: Our Head of Resources Management, who is also a member of our Board of Directors, and our CCO lead our cybersecurity program. Our Head of Resources Management has more than 30 years of overall experience and more than 20 years directly assessing and managing our cyber information technology and human resources systems, and the associated security concerns. Our CCO has more than 30 years of overall experience as a CPA, with more than 15 years managing information technology systems and databases, and more than 15 years supporting our Adviser's and Administrator's resource management department. This includes identifying, assessing, mitigating, and monitoring cyber information security risks. Our Director of IT has over 20 years of experience in IT, with a focus in the implementation of information security projects to enhance organizations' resilience against emerging threats, and has collaborated closely with security vendors/partners to contain and address cybersecurity incidents. These managers, as well as other management personnel, attend various professional continuing education programs, which include cybersecurity matters. Certain members of our Board of Directors have, or previously held, positions with other companies, including other public companies, that involved managing risks associated with their cyber and information technology systems.

companyName: GLADSTONE CAPITAL CORP

ticker: GLAD


text: We employ a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as third-party systems that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: BOYD GAMING CORP

ticker: BYD


text: Our incident response policy outlines our protocols for assessing, managing and responding to cyber incidents. This policy guides the response of our global IT team, which, depending on the significance of the incident, may include escalating the issue to executive management, notifying one or more members of our Board, maintaining communication with users and notifying law enforcement and other agencies if warranted. We may also receive assistance from a third-party security operations center (SOC) and other industry-leading third-party providers.

companyName: POOL CORP

ticker: POOL


text: Our CISO has over twenty years of professional experience, with twelve years in information security roles. He has been with Pega for five years and has a Master of Science degree from Northwestern University.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: As part of this program to keep our systems and data secure and to assist in understanding, assessing, identifying and managing material risks from cybersecurity threats, we take various measures through internal risk management efforts and testing by third-party experts. Those measures assess our cybersecurity program structure and capabilities and include blocking attempted cyber intrusions, defending against service disruptions, performing frequent vulnerability assessments and maintaining procedures to ensure timely notification of critical cybersecurity incidents and performance of related disclosure controls. We also have developed procedures and reporting processes when we identify an attempted cyber intrusion to the systems of one of our independent agents.

companyName: CINCINNATI FINANCIAL CORP

ticker: CINF


text: Board of Directors receives regular reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Viewbix Inc.

ticker: VBIX


text: The Board of Directors is responsible for overseeing the assessment and management of enterprise-level risks that may impact the Company. The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. Management reports on cybersecurity matters, including material risks and threats, to the Audit Committee at regularly scheduled Audit Committee meetings, which is then discussed with the Board of Directors. The reports discuss specific risks and mitigation efforts, including critical and high cyber risks from the risk register, the results of our annual independent review of the Company's cybersecurity posture and other third party assessments and benchmarking information.

companyName: MINERALS TECHNOLOGIES INC

ticker: MTX


text: The Audit Committee of our Board of Directors is primarily responsible for overseeing the Company's compliance and risk management obligations.

companyName: BRAINSTORM CELL THERAPEUTICS INC.

ticker: BCLI


text: Our cybersecurity program is built upon the National Institute for Standards and Technology and other best practice frameworks. We employ processes for assessing, identifying, and managing material risks from cybersecurity threats, including engaging an independent cybersecurity consultant to audit our systems and procedures, make recommendations for improvement and monitor remediation of any identified risks. We also conduct random vulnerability testing including network penetration testing, phishing, and social engineering tests. In addition, we also require Systems and Organization Control ("SOC") type reports from our service providers for our payroll and human resources system and stock administrator.

companyName: Nuvera Communications, Inc.

ticker: NUVR


text: Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our Board of Directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We consistently evaluate risks from potential cybersecurity threats, monitor our information systems for potential vulnerabilities and test these systems according to industry best practices. We have not encountered any cybersecurity incidents.

companyName: Signature Holdings Corp


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report, we have not identified any cybersecurity threats materially affecting, or reasonably likely to materially affect, our business strategy, results of operations, or financial situation. However, despite our efforts, we recognize the impossibility of eliminating all cybersecurity risks or guaranteeing the absence of undetected cybersecurity incidents that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information about these risks, refer to Part I, Item 1A, "Risk Factors," in this Annual Report on Form 10-K.

companyName: Hippo Holdings Inc.

ticker: HIPO


text: Integration of Risk Management Process Assessing, identifying, and managing cybersecurity-related risks is integrated into our overall risk management framework. The Cybersecurity Program is integrated into our enterprise risk management program and framework. These programs are designed to foster a company-wide culture of appropriate cybersecurity risk management. Our IT Security team works closely with stakeholders across technology, legal, risk, and business operations to implement and monitor the effectiveness of the Cybersecurity Program.

companyName: Bioventus Inc.

ticker: BVS


text: With oversight from our board of directors, the Audit Committee is primarily responsible for assisting our board of directors in fulfilling its ultimate oversight responsibilities relating to risk assessment and management, including relating to cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including processes and policies for determining risk tolerance, and reviews management's strategies for adequately mitigating and managing identified risks, including risks relating to cybersecurity threats.

companyName: Fold Holdings, Inc.

ticker: FLD


text: Risk Management and Strategy Assessing, Identifying and Managing Material Risks Our cybersecurity program is focused on assessing, identifying, and managing risks arising out of our use of information technology including the risk of cybersecurity incidents and threats. Our program is informed by recognized frameworks (such as the U.S. Department of Commerce's National Institute of Standards and Technology Cybersecurity Framework) and leverages external and internal expertise, as appropriate. Our program is integrated into our operations and is widely communicated to employees through annual employee and contractor cybersecurity awareness training, regular awareness exercises, and employee outreach activities including cybersecurity tech talks, on-site digital signage, intranet resources, CEO cybersecurity champion recognition at quarterly town hall meetings, and other targeted communications. These awareness measures are coupled with ongoing implementation of technology aimed to reduce vulnerabilities (including external testing and validation) and to monitor and assess threats. Our program includes monitoring on an ongoing basis by automated tools that detect threats and trigger alerts for assessment, investigation, and remediation by our internal cybersecurity team.

companyName: CONAGRA BRANDS INC.

ticker: CAG


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including an incident response policy, plan, procedures and scenario-based playbooks, an incident detection and response program, a vulnerability management program, disaster recovery and business continuity plans, risk assessment processes, security standards, network security controls, access controls, systems monitoring, employee awareness training, and cybersecurity insurance. The Company has obtained Trusted Information Security Assessment Exchange (TISAX) certification labels within the United States, Germany, and China. The Company is also continues working on its ISO 27001 certification.

companyName: GENTEX CORP

ticker: GNTX


text: We intend to work with outside counsel and third party service providers in the near term to further develop our expertise, processes and procedures with respect to cybersecurity protection and our response plan.

companyName: Tivic Health Systems, Inc.

ticker: TIVC


text: We strive to safeguard our important data, hardware, and internal network from digital attacks, theft and damage. In the ordinary course of our business, we collect, use, store, and digitally transmit confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. At Gyre Therapeutics, these processes are managed and monitored by a third-party information technology ("IT") consulting company (the "Managed Service Provider") and are overseen by our Chief Financial Officer. At Gyre Pharmaceuticals, these processes are managed and monitored by a dedicated IT team, which is led by the General Manager. Gyre Therapeutics' and Gyre Pharmaceuticals' processes include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data. For example, Gyre Therapeutics and Gyre Pharmaceuticals maintain software and hardware inventories, perform security monitoring and alerting, and complete ongoing risk assessments. Gyre Therapeutics and Gyre Pharmaceuticals also conduct regular employee trainings on cyber and information security, among other topics. In addition, both companies consult with outside advisors and experts on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: GYRE THERAPEUTICS, INC.

ticker: GYRE


text: Our management team, specifically our Chief Executive Officer and Chief Financial Officer, are responsible for the day-to-day administration of our business operations, including our risk management of cybersecurity risks. Our management is responsible for the design and implementation of policies, processes and internal controls to manage our cybersecurity risks. Our management team regularly meets with their information technology resources, including our third-party service providers, to ensure that we are appropriately positioned to manage our cybersecurity risks. Our management team also sponsors periodic cybersecurity awareness training for employees.

companyName: LiveOne, Inc.

ticker: LVO


text: In response, we have adopted a cybersecurity program to manage cybersecurity risks, prioritizing the protection of data entrusted to us by our customers and other stakeholders. We employ various mechanisms, controls, technologies, and processes aimed at assessing, identifying, and managing these risks.

companyName: OppFi Inc.

ticker: OPFI


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our organization. For additional discussion related to the Company's consideration of cybersecurity risks and their potential impact on our business strategy, results of operations, or financial condition, please refer to Part I, Item 1A. "Risk Factors" in this document.

companyName: ALASKA AIR GROUP, INC.

ticker: ALK


text: We have implemented cybersecurity risk management procedures, in accordance with our risk profile and business size, that are designed to identify, assess, and mitigate risks from current and emerging cybersecurity threats. Our cybersecurity procedures, which are informed by the National Institute of Standards and Technology cybersecurity framework, are supported by a third-party managed services provider that assists us in managing our information technology systems.

companyName: Aura Biosciences, Inc.

ticker: AURA