text: Our board of directors has approved management committees including the Information Technology Risk Committee, which focuses on technology impact, and the Information Security Oversight Committee, which focuses on business impact. These committees provide oversight and governance of the technology program and the information security program. These committees are chaired by managers within the enterprise information security department and include the Chief Information Security Officer and Chief Information Officer as well as their direct reports and other key departmental managers from throughout the entire company. These committees generally meet monthly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Chief Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Technology Committee of our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).

companyName: CULLEN/FROST BANKERS, INC.

ticker: CFR


text: Cybersecurity Risks As discussed above and under Item 1A. Risk Factors—General Risk Factors, we face a number of cybersecurity risks across our various businesses, and we have experienced threats to and unauthorized intrusions of our systems, technology and infrastructure from time to time. While to our knowledge we have not, to date, experienced a cybersecurity incident or threat that has materially and adversely affected our business, financial condition and results of operations, we cannot provide assurances that they will not be materially affected in the future by such incidents.

companyName: Angi Inc.

ticker: ANGI

secItem: Item 1C


text: At the BlackRock parent level, BlackRock's Board is actively engaged in the oversight of BlackRock's risk management program. The Risk Committee assists the Board with its oversight of BlackRock's levels of risk, risk assessment, risk management and related policies and processes, including risks arising from cybersecurity threats. The Risk Committee receives regular reports on BlackRock's cybersecurity program, technology resilience risk management and related developments from members of our information security team, including the CISO. The Board and the Risk Committee also receive information regarding cybersecurity incidents that meet certain reporting thresholds. On an annual basis, senior members of BlackRock's technology, risk and information security teams provide a comprehensive overview of BlackRock's cyber risk and related programs to a joint session of the Board's Risk and Audit Committees.

companyName: BlackRock TCP Capital Corp.

ticker: TCPC


text: In 2023, we did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors - Risks Related to our Business" in this Annual Report on Form 10-k.

companyName: OLYMPIC STEEL INC

ticker: ZEUS


text: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: Pluri Inc.

ticker: PLUR


text: Management's Role in Cybersecurity Risk Management Our management, including our Chief Operating Officer and Chief Compliance Officer, is responsible for assessing and managing material risks from cybersecurity threats. Members of Company management possess relevant expertise in various disciplines that are key to effectively managing such risks, such as information systems technology, cybersecurity, regulatory compliance and corporate governance. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from service providers and reliance on communications with legal, operations, information technology, and/or compliance personnel.

companyName: Hercules Capital, Inc.

ticker: HTGC


text: We maintain our Program with physical, administrative and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent and respond to cybersecurity incidents. Elements of our Program include: (i) required training for our employees (including onboarding and annual training), exercises (including advanced phishing exercises), and awareness for our employees to promote vigilance of cybersecurity risks and (ii) compliance audits and assessments, which include routine technical and non-technical audits and assessments internally and in collaboration with independent third parties at least annually. In addition, we engage various third-party consultants to assist us in assessing, enhancing, implementing and monitoring our Program and responding to incidents.

companyName: InnovAge Holding Corp.

ticker: INNV


text: The Chair of the Audit Committee is regularly informed of both material and non-material cybersecurity risks and incidents. The full Audit Committee is notified any time our incident response program has determined that a cybersecurity incident is material or requires reporting to a regulatory body.

companyName: CAVCO INDUSTRIES, INC.

ticker: CVCO


text: Our Chief Information Security Officer leads our information security team and works with Palantir's other departments in areas such as facilities, physical security, operations, data protection, information technology, product development, finance, legal and compliance, where necessary in assessing and reviewing risks and identifying actions to be taken. As part of our overall approach to risk management, we monitor and evaluate the sufficiency of our policies, processes and controls, including with respect to cybersecurity risks and process.

companyName: Palantir Technologies Inc.

ticker: PLTR


text: Our CISO has over 20 years of experience in information security leadership roles and over 8 years as our CISO. Nearly half of our board of directors have completed cybersecurity program trainings or have cybersecurity and information security industry experience.

companyName: TE Connectivity plc

ticker: TEL


text: At the management level, the STEP Head of IT, who has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at STEP and elsewhere, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices and reports directly to the President and Co-Chief Operating Officer of STEP. The Head of IT receives reports on cybersecurity threats from his team and external service providers on an ongoing basis and, in conjunction with management, reviews risk management measures implemented by STEP to identify and mitigate data protection and cybersecurity risks, including those applicable to the Company and the Advisor. The Head of IT works closely with the STEP Legal and Compliance departments to oversee compliance with legal, regulatory and contractual security requirements and in developing reports and presentations to the STEP Board and its Audit Committee, as well as to the Company's Board. The Head of IT is responsible for providing regular training to STEP employees, including employees of the Advisor, in respect of information security. Risk Management and Strategy.

companyName: Stepstone Private Credit Fund LLC


text: Our cybersecurity and risk management program is intended to protect the confidentiality, integrity, and availability of our critical information systems and the data resident on them. We have designed our IT systems and processes with the intention that our solutions should defend against the ever-evolving threat landscape while remaining agile to keep up with such threats. We have established processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to safeguard our information assets and operations from internal and external cyber threats, including protecting employee information from unauthorized access to or attacks on our networks and systems. These processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine reviews of our policies and procedures to identify risks and enhance our practices. We also employ processes to identify material risks from cybersecurity threats associated with our use of third-party service providers.

companyName: Bridgeline Digital, Inc.

ticker: BLIN


text: Information security risks have significantly increased in recent years in part because of the proliferation of new technologies, the increasing use of the Internet and telecommunications technologies to conduct our operations, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties, including, among others, foreign state agents. Our business and operations rely on the secure and continuous processing, transmission and storage of confidential, proprietary and other information in our computer systems and networks, including sensitive personal information, such as PHI, social security numbers, and/or credit card information of our patients, teammates, physicians, business partners and others. Our business and operations also rely on certain critical IT vendors that support such processing, transmission and storage (which have become more relevant and important given the information security issues and risks that are intensified through our increased use of remote work arrangements).

companyName: DAVITA INC.

ticker: DVA


text: Within the principal functions of the Risk Committee are its responsibilities in overseeing cybersecurity risk, information security, and technology risk, as a well as management's actions to identify, assess, mitigate, and remediate material issues. On a quarterly basis, our Executive Vice President of Technology provides information to our Chief Financial Officer, who reports to our Chief Executive Officer and the Risk Committee on our cybersecurity risk capabilities and threats.

companyName: INDEPENDENCE REALTY TRUST, INC.

ticker: IRT


text: The JFG Board's Risk and Liquidity Oversight Committee oversees JFG's enterprise risk management. Oversight includes reviewing and approving annually JFG's risk management framework and overarching risk appetite statements; reviewing JFG's technology, cybersecurity and privacy risk, legal and regulatory risk, and reputational risk,among other JFG major risk exposures; reviewing the steps management has taken to monitor and control such exposures; and reviewing JFG's capital, liquidity and funding against established risk methodologies. The CISO keeps the JFG Board informed about JFG's security posture and cybersecurity maturity program on a regular basis, providing updates about cybersecurity events, significant incidents, and new initiatives.

companyName: Senior Credit Investments, LLC


text: In fiscal 2025, THOR did not identify any material cybersecurity threats, including as a result of any previous cybersecurity incident, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or may not accurately assess the risks of incidents, and such preventive measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Moreover, we, our suppliers and our dealers have been the target of cybersecurity incidents in the past and may be subject to such incidents in the future. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: THOR INDUSTRIES INC

ticker: THO


text: Cybersecurity is an important part of our risk management and strategy activities and an area of focus for our Board and management. Our Audit Committee is responsible for reviewing and monitoring our cybersecurity and information security policies and our internal controls regarding cybersecurity and information security. Our Audit Committee receives regular reports from members of our senior management and other personnel that include assessments and potential mitigation of the risks and exposures to cybersecurity incidents.

companyName: ICHOR HOLDINGS, LTD.

ticker: ICHR


text: Central management and coordination of the program helps FirstEnergy to comprehensively evaluate and protect against cyber threats. FirstEnergy's policies and procedures identify how cyber security measures and controls are developed, implemented, and regularly reviewed and updated. FirstEnergy aims to align its cyber security program with national standards. For example, FirstEnergy has implemented and maintains a set of controls to manage cyber security risk based on the National Institute of Standards and Technology Cyber Security Framework and, for Bulk Electric System assets, the NERC Critical Infrastructure Protection standards. FirstEnergy also complies with various state laws and regulations on cyber security.

companyName: FIRSTENERGY CORP

ticker: FE


text: Pursuant to its charter, the Audit Committee of our board of directors oversees our risk management program, which focuses on the most significant risks we face, including cybersecurity risks. Audit Committee meetings include discussions of specific risk areas, and our Chief Compliance Officer, or our CCO, regularly reports to the Audit Committee on cybersecurity risks we face, as well as the status of measures undertaken by the Company to manage those risks. Pursuant to our Incident Response Plan, the chair of the Audit Committee will be notified in the event of a cybersecurity incident meeting a specified severity level. In addition, all members of our board of directors, including members of the Audit Committee, participate in quarterly training on cybersecurity threats, including those facing the Company.

companyName: Granite Point Mortgage Trust Inc.

ticker: GPMT


text: The Cybersecurity Steering Committee regularly reports to the CFO through the CTO and reports annually on cybersecurity to the Audit Committee during a scheduled meeting. These reports include, as appropriate, updates on the current cybersecurity landscape, incident trends, and any significant developments that may impact the Partnership's security posture.

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: This includes considering the engagement of external cybersecurity experts to advise on best practices, conducting vulnerability assessments, and developing an incident response strategy. Our goal is to establish a cybersecurity framework that is commensurate with our size, complexity, and the nature of our operations, thereby reducing our exposure to cybersecurity risks.

companyName: La Rosa Holdings Corp.

ticker: LRHC


text: The CIO has extensive leadership experience with 25 years of experience in information technology, project management, business applications including manufacturing. The CISO is responsible for overseeing our cybersecurity risk management program, in coordination with the CIO and our other business leaders, including in the legal, internal audit, finance and risk management departments. The CISO has extensive cybersecurity knowledge and skills gained from over 25 years of technical and business experience in the cybersecurity and information security fields. The CISO reports directly to the CIO who in turn reports directly to the CEO. The CISO receives reports on cybersecurity threats on an ongoing basis and, regularly reviews risks to identify and mitigate data protection and cybersecurity risks. The CISO and CIO also work closely with our legal department to oversee compliance with applicable legal, regulatory and contractual security requirements.

companyName: WORTHINGTON ENTERPRISES, INC.

ticker: WOR


text: We engage third-party services to conduct penetration testing as well as other regular evaluations of our security protocols and processes. Additionally, we assess and monitor the cybersecurity controls of third party service providers and partners. Ongoing and regular monitoring of our third parties is also managed through our ISP team's protocols in partnership with the vendor management, enterprise risk management, and internal audit departments.

companyName: Triumph Financial, Inc.

ticker: TFIN


text: We design and assess our cybersecurity risk management program in accordance with National Institute of Standards (NIST) standards and guidelines to protect all proprietary and guest data. Key components of our cybersecurity risk management program include the following:

companyName: Six Flags Entertainment Corp/OLD


text: Our IT Systems Administrator is responsible for assessing and managing our risks from cybersecurity threats and oversees our cybersecurity program. The IT Systems Administrator reports directly to our Chief Financial Officer (CFO). Our IT Systems Administrator holds an associate degree in computer application and support and has served in various roles in information systems administration for over eight years, including roles involving managing information technology and systems and implementing cybersecurity programs.

companyName: PERPETUA RESOURCES CORP.

ticker: PPTA


text: In addition, assessing, identifying, and managing cybersecurity-related risks are integrated into our overall enterprise risk management ("ERM") process. Cybersecurity risks are included in the risk universe that the ERM function evaluates, with input from information security subject matter experts at the Company, to assess top risks to the enterprise. The ERM process provides input into our strategic planning process, such as development of action plans to address and mitigate identified risks. By integrating cybersecurity risk into the overall ERM process in this manner, the Company is better equipped to identify, assess, and manage material cybersecurity risks.

companyName: Dave & Buster's Entertainment, Inc.

ticker: PLAY


text: Our security incident response plan ("SIRP") is designed to escalate certain cybersecurity incidents to members of the Company's executive management team depending on the circumstances. The Chief Financial Officer and relevant department heads work with our incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. The SIRP provides for escalation of potentially material cybersecurity incidents to the Audit Committee.

companyName: Loop Industries, Inc.

ticker: LOOP


text: We engage assessors or other third-party service providers in connection with our risk assessment and cybersecurity assessment or audit processes. These service providers assist us to evaluate risks and identify where our current security program may be improved. We consult with these service providers as required to verify mitigation approaches, to compare Blend's security posture against industry peers, and to provide overall feedback for the security program. Additionally, we utilize outside service providers, as well as a bug bounty program, to penetration test our network infrastructure and applications and provide prioritized security vulnerability findings reports that we include as part of our risk assessment processes. Some Blend customers also perform annual security testing on Blend's infrastructure and applications.

companyName: Blend Labs, Inc.

ticker: BLND


text: • Performance Evaluation: Included in the board's annual evaluation of the performance of the Company's chief executive officer is the effectiveness of implementing cybersecurity policy and measures, ensuring that cybersecurity policies and practices are effective and aligned with organizational goals. • Cybersecurity Culture: The board fosters a cybersecurity-aware culture throughout the organization, supporting management's efforts to build risk management including cyber into the fabric of the operating culture.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations and many states have recently implemented or modified their data breach notification and data privacy requirements. The Company expects this trend of state-level cybersecurity regulatory activity to continue, and continues to monitor these developments.

companyName: FARMERS NATIONAL BANC CORP /OH/

ticker: FMNB


text: Cybersecurity is among our Board's oversight priorities. Through their oversight role, the Board has allocated oversight of cybersecurity risk to our Audit Review Committee of the Board. Our Audit Review Committee plays a vital role in our cybersecurity risk management process and regularly reviews the Company's cybersecurity and other information technology risks, controls and procedures. At multiple points throughout the year, management provides the Audit Review Committee with updates to our cybersecurity risk management process and our security monitoring and protection systems. The Audit Review Committee is kept informed of new security solutions planned for deployment. As part of their regular review of reports from management, the Audit Review Committee regularly reports cybersecurity risk updates to the Board, which enables the Board to incorporate the insights of such reports into its overall risk oversight analysis.

companyName: Hamilton Beach Brands Holding Co

ticker: HBB


text: Index to Financial Statements The above cybersecurity risk management processes are integrated into our overall risk management program. Cybersecurity threats are understood to be dynamic and to intersect with various other enterprise risks. As such, cybersecurity is considered an integral component of our enterprise-wide risk management approach. As of the date of this Report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Partnership.

companyName: PLAINS GP HOLDINGS LP

ticker: PAGP


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature.

companyName: Nuvation Bio Inc.

ticker: NUVB


text: External Assessments BancPlus' cybersecurity program, including the related policies, standards, processes, and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities, including information security maturity assessments, audits and independent reviews of the Company's information security control environment and operating effectiveness. Reports and significant findings from these assessments are provided to management and the Risk Committee of the BancPlus board of directors. The Company's cybersecurity program is reviewed by the BancPlus board of directors at least annually and is adjusted based on the information provided from these assessments and other recommendations from the Cybersecurity Committee.

companyName: BANCPLUS CORP


text: Our CISO takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: ServiceTitan, Inc.

ticker: TTAN


text: The designated committee oversees our cybersecurity risk assessment and mitigation strategies through various means, including but not limited to: Conducting internal evaluations and leveraging technological tools to fortify our cybersecurity posture. Implementing rigorous cybersecurity training for all employees to heighten awareness and preparedness against cyber threats. Ensuring the robustness of our cyber defenses with comprehensive antivirus solutions and adherence to cybersecurity best practices.

companyName: PAID INC

ticker: PAYD


text: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our CISO, who is a member of our executive management team and closely coordinates as needed with other senior management personnel including the President of Product, Technology, and Operations and the Chief Legal Officer, who collectively possess significant experience in evaluating, managing and mitigating security and other risks, including cybersecurity risks.

companyName: SentinelOne, Inc.

ticker: S


text: Related to Cybersecurity Risks The full Board of Directors conducts several reviews throughout the year in an effort to ensure that our cyber strategy and risk management is appropriate and prudent. It is the responsibility of the Board of Directors to understand and oversee our strategic plans, the associated risks, and the steps that our senior management team is taking to manage and mitigate those risks. Principle responsibility in this domain is shared by our Chief Risk and Compliance Officer, who has approximately 20 years of leadership experience in the financial services sector with an extensive background in the mortgage industry, and our Chief Information Officer who has approximately 20 years of experience leading technology and product engineering functions.

companyName: Maverick Merger Sub 2, LLC

ticker: COOP


text: T&S also partners with other dedicated teams which report to our CTO: • Operations and Analytics, which is responsible for identifying and measuring consumer fraud and abuse of our customer-facing services, implementing manual and automated operations to ensure these are within acceptable bounds, and working with our product and engineering teams to design and implement longer term solutions. • Security and Fraud Engineering, which is responsible for building libraries, services, and integrations that interface with both backend and vendor systems to support the objectives of T&S.

companyName: CHEGG, INC

ticker: CHGG


text: In fiscal year 2024, our crypto-processing subsidiary engaged an external consultant to conduct a cybersecurity risk assessment of our business operations. This assessment examined both internal and external threats to our systems and data handling processes, providing a structured framework for evaluating, prioritizing, and enhancing our cybersecurity initiatives. On a going-forward basis, in collaboration with our Audit Committee, management will determine and implement appropriate measures based on these findings.

companyName: ALT5 Sigma Corp

ticker: ALTS


text: Beyond identification and assessment, the Company uses automated and human-staffed monitoring and other systems to respond to and otherwise manage cybersecurity threats and potential cybersecurity incidents. The Company has developed and implemented practices and policies that will guide the Company through responding to actual and suspected cybersecurity incidents.

companyName: LOGILITY SUPPLY CHAIN SOLUTIONS, INC


text: • Physical Security—We also maintain physical security measures to protect our OT systems, consistent with a defense in-depth and risk-tiered approach. Such physical security measures may include access control systems, video surveillance, around-the-clock command center monitoring, and physical barriers (such as fencing, walls, and bollards). Additional features of PSEG's physical security program include threat intelligence, insider threat mitigation, background checks, a threat level advisory system, a business interruption management model, and active coordination with federal, state, and local law enforcement officials. See Item 1. Business. Regulatory Issues—Federal Regulation for a discussion of Critical Infrastructure Protection standards that the NERC has promulgated that mitigate risk associated with both cybersecurity and physical security of PSEG's critical facilities.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: Cybersecurity threats continue to increase in frequency and sophistication, thereby increasing the difficulty of detecting and defending against them. Furthermore, the potential risk of security breaches and cyberattacks may increase as we introduce new service offerings. Any future events impacting us or our third-party vendors that damages or interrupts our or our third-party vendors' computer, technology, and communications hardware and software systems, or exposes intellectual property or data or other confidential information, could have a material adverse effect on our operations, reputation, and financial results.

companyName: BuzzFeed, Inc.

ticker: BZFD


text: Despite the continuous risk faced by the Company, we have suffered no incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, nor have we had any widespread intrusion or incident. Notwithstanding the exhaustive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations and financial condition. While GXO maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: GXO Logistics, Inc.

ticker: GXO


text: The Company has a dedicated cybersecurity incident response team responsible for managing and coordinating the Company's cybersecurity incident response efforts. This team also collaborates closely with other teams in identifying, protecting from, detecting, responding to, and recovering from cybersecurity incidents. Cybersecurity incidents that meet certain thresholds are escalated to the Cybersecurity Leaders and cross-functional teams on an as-needed basis for support and guidance. Additionally, this team tracks cybersecurity incidents to help identify and analyze them. The Company's cybersecurity incident response team partners with the Company's internal cybersecurity teams as well as with external legal advisors, communication specialists, and other key stakeholders as appropriate to respond to cybersecurity incidents. The Company maintains a cybersecurity incident response plan to prepare for and respond to cybersecurity incidents. The incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management. Additionally, the Company conducts at least one cybersecurity tabletop exercise on an annual basis, where members of a cross-functional team engage in a simulated cybersecurity incident scenario. This preparedness exercise is intended to provide hands-on training for the participants and helps the Company assess its processes and capabilities in addressing cybersecurity threats.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: Our Sponsor's IT team, led by its Chief Information Officer, is responsible for assessing and managing our significant risks from cybersecurity threats and has primary responsibility for our risk management process and overall cybersecurity risk management program. This team includes in-house personnel devoted to these efforts, as well as a third-party IT firm, and they collectively have extensive knowledge of the technologies and applications we have adopted to address our cybersecurity risk.

companyName: Strategic Storage Trust VI, Inc.

ticker: SGST


text: These controls and processes are reviewed periodically and include the following activities: • we monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices, and contracts (as applicable), we require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • we utilize technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, virtual private networks (VPN), Web Application Firewalls (WAF), intrusion detection systems, antivirus and endpoint detection and response software, multi-factor authentication (MFA), data encryption, encrypted backups, vulnerability scanning and patching, email anti-phishing technology, malicious URL and IP filtering, application controls, USB control and threat intelligence services; • our cybersecurity personnel include certified security professionals who are experienced in networks, computer systems, cloud cybersecurity, cybersecurity risk management, incident response, and security awareness training; • we regularly test and monitor our cybersecurity defenses to ensure that they are effective; and • we also conduct security awareness training for all employees to help them identify and mitigate cybersecurity risks.

companyName: MYRIAD GENETICS INC

ticker: MYGN


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and customer data that use to provide services for our customers ("Information Systems and Data").

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: Our daily operations are continuously monitored. We monitor traffic traversing our computer networks and have implemented IT controls and processes to secure our business applications and prevent unauthorized access to or the loss of sensitive data. Our controls include the use of multiple encryption layers for data in transit and at rest, multi-factor authentication, data classification, and data loss prevention. We plan to assess the adequacy of our cybersecurity IT controls through annual cybersecurity vulnerability testing.

companyName: OXBRIDGE RE HOLDINGS Ltd

ticker: OXBR


text: In the event of an incident, we intend to follow our cybersecurity incident response plan, which outlines the steps to be followed from incident detection to mitigation, and notification. We contract with external firms that have extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks. As a biopharmaceutical company, we must comply with extensive regulations, including requirements imposed by the Federal Drug Administration related to adequately safeguarding patient information and reporting cybersecurity incidents to the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach. We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a clinical site, subcontractor, or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to our IT Incident Response Coordinator who will investigate the direct impact of the incident. Once a potential incident has been confirmed, the Incident Response Coordinator will notify senior management that activation of the incident response plan is required and assign a severity rating, ranging from none to critical, based on the perceived impact.

companyName: Cardiff Oncology, Inc.

ticker: CRDF


text: As part of our information security program, our CIO and his team integrate our information security measures into our overall risk management processes to identify, evaluate, and quantify risks based on internal and external available information and classify the severity of potential cybersecurity incidents. XPO employs technical measures to protect against cybersecurity attacks that align with functions identified in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The information security team continuously reviews our information security systems for unauthorized system access, cybersecurity incidents, indicators of compromise, and unusual traffic on our systems. The information security leadership team meets regularly to ensure our processes to identify, assess, and manage cybersecurity threats, including those posed by third-party service providers who provide services to our business, are effective and current. Our information security team also reviews relevant legislative and regulatory developments and conducts regular and tailored information security training for our global workforce, in various formats.

companyName: XPO, Inc.

ticker: XPO


text: Our Enterprise Risk Management Committee, together with the company's security and legal teams as well as third party service providers, help identify, assess and manage the Company's cybersecurity threats and risks. Additionally, the Enterprise Risk Management Committee, the security team, the legal teams and the Company's third party service providers identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting assessments of controls, conducting threat and vulnerability assessments, and engaging in simulated penetration testing and tabletop incident response exercises organized by third-party specialists.

companyName: Poseida Therapeutics, Inc.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we plan to engage external experts, including consultants and auditors, in evaluating and testing our risk management systems. These services will enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties is expected to include annual audits, ongoing threat assessments, and regular consultations on security enhancements.

companyName: Signing Day Sports, Inc.

ticker: SGN


text: Our Chief Scientific Officer and our President and Chief Operating Officer are responsible for engaging appropriate personnel and companies, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant employees and personnel. Our President and Chief Operating Officer is also responsible for managing budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: CalciMedica, Inc.

ticker: CALC


text: Cybersecurity risks deemed to be critical are reviewed by a Critical Threat Committee, which is comprised of members of our senior leadership team including our Chief Financial Officer, Chief Legal Officer, Chief Digital Officer, Chief Operating Officer, Chief Technology Officer, and Controller. The Critical Threat Committee reviews the risk and mitigation plan with the applicable cross-functional management team and facilitates notification to the Audit Committee of emerging critical cybersecurity risks. The Audit Committee and the Board of Directors receive regular briefings on cybersecurity risks. See "—Governance" below for further discussion of governance of our cybersecurity program.

companyName: CARRIER GLOBAL Corp

ticker: CARR


text: The Company maintains a Cybersecurity Incident Response Plan ("CIRP") that establishes a foundation for capture, containment, escalation, and response to cybersecurity events across the Company. The CIRP details how the Company, including the SOC and cybersecurity team, prioritize and respond to cybersecurity events and incidents, including when and how incidents are escalated to key members of management who in turn determine whether further escalation to the Audit Committee or Board is appropriate. The CIRP also includes actions designed to enhance processes and responsiveness to address and prevent future incidents.

companyName: Ferguson Enterprises Inc. /DE/

ticker: FERG


text: Risk Management & Strategy Rocky Brands recognizes the critical importance of developing, implementing, and maintaining a robust information security program to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have established information security programs and policies, including processes for identifying, assessing, and managing risks arising from cybersecurity threats. These processes involve regular assessments of our information systems and infrastructure to identify vulnerabilities and threats. We focus on executing a centralized information technology and cybersecurity program. Our Company-wide approach is to be positioned as one security program, one posture and one roadmap for the enterprise. This platform is administered across our departments by our cybersecurity team led by our Vice President of Information Technology. Our information security programs and policies are aligned with those of the Center for Internet Security (CIS), Control Objectives for Information Technologies (COBIT), and National Institute of Standards Technology (NIST).

companyName: ROCKY BRANDS, INC.

ticker: RCKY


text: Risks from Material Cybersecurity Threats As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the Company. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company has experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. Further, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Our business and operations could be materially and adversely impacted by cybersecurity incidents. For a detailed discussion of the Company's cybersecurity related risks, refer to "Operational Risk" within Part I, Item 1A. Risk Factors of this Annual Report.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: Governance - management's responsibility The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity controls designed to address cybersecurity threats and risks. The Chief Information Officer (CIO), who is a member of the Company's Executive Committee, and the Chief Information Security Officer (CISO) are responsible for assessing and managing cybersecurity risks, including security incident detection, response, and recovery.

companyName: JOHNSON & JOHNSON

ticker: JNJ


text: The success of the Company's information security program relies not only on ownership by the CIO's organization but also an active and collaborative relationship within the business. The Company requires all employees to complete cyber training annually. For fiscal 2023, the Company maintained a security learning management system with phishing simulations distributed regularly to enhance cyber resiliency. Additionally, the Company leverages communications, contests, policies, videos, and visuals to continuously raise awareness among employees.

companyName: Dorman Products, Inc.

ticker: DORM


text: GIS maintains an Incident Management and Response Policy that provides a classification framework for cybersecurity incidents and defines critical roles and responsibilities during a cybersecurity incident. The Incident Response Policy specifies ownership and timing of key actions and prescribes the engagement of functional leaders, senior Executives, and the Board of Directors, depending on the incident. We have developed playbooks to guide specific actions related to different incident types. Finally, we have a cyber insurance policy underwritten by a global leader in commercial insurance solutions.

companyName: Spirit AeroSystems Holdings, Inc.


text: Our Senior Director and Head of Information Technology and our management committee on cybersecurity oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Senior Director and Head of Information Technology is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents by leading the implantation of the cybersecurity risk management program and working directly with our security team. The Senior Director and Head of Information Technology also provides appropriate information and updates to our management committee on cybersecurity.

companyName: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.

ticker: PACB


text: We assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop remediation or mitigation controls and safeguards. We conduct regular reviews and tests of our information security program including penetration and vulnerability testing to evaluate the effectiveness of our information security program and improve our security measures and planning. Risk Assessment: Regular assessments identify and prioritize technical risks to critical assets through threat identification and vulnerability assessments.

companyName: Paragon 28, Inc.


text: Our Board of Directors has overall responsibility for risk oversight and oversees the implementation and continuous improvement of our cybersecurity program and compliance with disclosure requirements. The Board of Directors receives regular reports and periodic briefings from the Chief Executive Officer (in view of the absence of a Chief Financial Officer) on cybersecurity matters, including key risks to the Company, recent developments, and risk mitigation activities. Our cybersecurity program is overseen by the Chief Executive Officer (in view of the absence of a Chief Financial Officer) in conjunction with a third-party service provider. The third-party service provider has the primary responsibility for the Company's cybersecurity risk management program. At the time an incident is identified, the Company completes an evaluation and summarizes the incident that is shared with the Board of Directors to effectively manage resources to reduce risk and prevent future incidents.

companyName: SMITH MIDLAND CORP

ticker: SMID


text: Our Board, supported by the Audit Committee, oversees our risk management process. The Audit Committee receives, at a minimum, quarterly presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any material cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Velo3D, Inc.

ticker: VELO


text: Despite our efforts, there is the ever-present risk that our systems and/or data will suffer a successful cyber incident such as unauthorized access, use, disclosure, modification, or destruction by hackers, cybercriminals, state-sponsored actors, insiders, or other malicious actors. We have experienced attempts to compromise our systems and/or data. These attempts included phishing attacks, malware infections, and unauthorized access attempts. We do not believe that these attempts, if successful, would have resulted in a material adverse effect on our business, financial condition, or results of operations. We continue to be diligent in preventing, detecting, and responding to a cyber incident. However, we cannot guarantee that we will not suffer cybersecurity incidents in the future, which could result in: • Loss of or damage to our data, intellectual property, or other proprietary or confidential information; • Interruption or degradation of our operations, services, or systems availability; • Compromise or corruption of our data or systems integrity; • Reputational harm or loss of customer trust or confidence; • Legal liability, regulatory fines, penalties, or sanctions; • Remediation or mitigation costs, such as increased security expenditures, investigation expenses, or litigation fees; • Increased insurance premiums or difficulty in obtaining adequate insurance coverage; or • Other negative consequences. Any of these outcomes could have a material adverse effect on our business, financial condition, or results of operations.

companyName: COMSTOCK RESOURCES INC

ticker: CRK


text: We recognize the critical importance of maintaining the trust and confidence of patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. In general, we seek to address cybersecurity risks through a comprehensive approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: GRI Bio, Inc.

ticker: GRI


text: In fiscal year 2025, STERIS did not experience any cyberattack or other attempted intrusion or other incident with respect to our information systems that materially affected or was likely to materially affect our business strategy, results of operations, financial condition or cash flows. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced or will not experience in the future undetected cybersecurity incidents. For more information about these risks, please see "Item 1A Risk Factors" in this annual report on Form 10-K.

companyName: STERIS plc

ticker: STE


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity, including immediate notification of any material cybersecurity events, and information technology matters and related risk exposures from our Executive Vice President of Technology as well as other members of the senior leadership team. The Audit Committee also reviews reports from third party service providers and discusses the findings with management. The Board receives updates from management and the Audit Committee on cybersecurity risks.

companyName: NOODLES & Co

ticker: NDLS


text: The Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected the Company, including its operations, business strategy, results of operations, or financial condition. The Company faces certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the Company, including its operations, business strategy, results of operations, or financial condition. See "Risk Factors – Risks Related to Information Technology, Cybersecurity and Data Privacy."

companyName: O-I Glass, Inc. /DE/

ticker: OI


text: We continue to face significant and persistent cybersecurity risks and our business has both an increasing reliance on systems and an increasing digital footprint as a result of changing technologies, connected devices and digital offerings, as well as expanded remote work policies. We regularly assess our threat landscape and monitor our systems and other technical security controls, maintain information security policies and procedures, including a breach response plan, take steps to ensure maintenance of backup and protective systems, and have a team of security personnel managing our efforts and initiatives. We regularly review our policies, practices, and plans with assistance from third party experts and advisors for certification purposes, including with respect to SOC 2 certifications and Payment Card Industry Data Security Standard (PCI-DSS) certifications where relevant, and leverage third party resources to support our cyber risk defense, monitoring and response processes. We conduct security assessments and periodic re-assessments on key third party partners and other service providers with access to information assets of Dover. We review independent audit reports from key third party partners and other service providers with access to information assets at least annually. In addition, our online employees are required to participate in cyber, information security, and privacy training at least annually.

companyName: DOVER Corp

ticker: DOV


text: The CISO receives reports on cybersecurity threats from other internal information security personnel on an ongoing basis and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate cybersecurity risks. The CISO also attends meetings of the board of directors to report on any material developments. We have protocols by which certain cybersecurity incidents are reported promptly to management and the legal team.

companyName: MAGNITE, INC.

ticker: MGNI


text: The Risk Committee meets five times a year during which management provides updates to the committee regarding the material risks facing the Company. As part of this reporting, the Chief Risk Officer and the Risk Management Department have created a risk management program that identifies and evaluates the risks associated with various aspects of the Company's business and report their assessments to the Risk Committee for review or approval. Within the risk management process, cybersecurity risks are specifically reviewed and addressed, including risks related to current or proposed products and services to be offered by the Company, as well as the efforts taken or to be taken to mitigate such risks.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: Our management team, led by our CISO and CCO, stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.

companyName: ALKAMI TECHNOLOGY, INC.

ticker: ALKT


text: The Company is ISO/IEC 27001:2013 certified, which is a global standard that specifies the requirements for establishing, implementing, maintaining, and continually improving information security management systems. Additionally, we have received an independent examination regarding our compliance with SOC 2 Type 1 and Type 2.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: The Audit Committee of the Board (the "Audit Committee") has been designated as the board committee with oversight responsibility of cybersecurity as delegated in the Audit Committee charter. The below summarizes the role and the frequency in which the Audit Committee oversees and monitors cybersecurity risks: • At least annually the Vice President of Technology presents compliance activities related to cybersecurity to the Audit Committee which includes those activities related to compliance with the cybersecurity disclosure regulations; • Any material breaches would be disclosed to the Audit Committee either in regularly scheduled meetings or in calls with the Chair of the Audit Committee if the communication is urgent; • Periodically, the Vice President of Information Technology provides updates to the Audit Committee on internal controls surrounding information technology (including cybersecurity); • The Chair of the Audit Committee provides regular updates during the Audit Committee meeting activities which includes cybersecurity; and • The Vice President of Information Technology presents updates on the cybersecurity program to the Company's Board annually.

companyName: POWER SOLUTIONS INTERNATIONAL, INC.

ticker: PSIX


text: Since the Company's inception, it has not experienced a cybersecurity incident that has materially affected the Company, its business strategy, its results of operations, or its financial condition.

companyName: Diameter Credit Co


text: We acknowledge the increasing importance of cybersecurity in today's digital and interconnected world. Cybersecurity threats pose significant risks to the integrity of our systems and data, potentially impacting our business operations, financial condition and reputation.

companyName: VitaNova Life Sciences Corp

ticker: VNOV


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is always present. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. Despite our efforts, we cannot guarantee that our security measures and controls will be sufficient or effective to prevent, detect, or mitigate all cybersecurity incidents or to protect our systems and data from unauthorized access, use, or disclosure. We may experience cybersecurity incidents in the future that could result in operational disruption, reputational damage, customer dissatisfaction, loss of business or revenue, legal liability, regulatory actions, fines, penalties, or remediation costs. Any of these outcomes could have a material adverse effect on our business, operations, and financial condition. While we have experienced cybersecurity incidents in the past, risks from cybersecurity threats have not materially affected the Corporation to date.

companyName: MUNCY COLUMBIA FINANCIAL Corp

ticker: CCFN


text: We provide regular, mandatory, and ongoing training and reinforcement for personnel regarding cybersecurity threats to help equip our personnel with tools to address such threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: VERACYTE, INC.

ticker: VCYT


text: Under the Cybersecurity and Privacy Programs, our Security Team monitors, prevents, detects, mitigates, and remediates cybersecurity risks and incidents via various means, including monitoring threat intelligence from various sources, internal and external vulnerability management, and alerts and reports produced by security tools. Reporting of such risks is regularly provided to the Board and the Audit and Risk Committee, as applicable.

companyName: GoodRx Holdings, Inc.

ticker: GDRX


text: We engage consultants and other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Ventyx Biosciences, Inc.

ticker: VTYX


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as appropriate based on the information provided by these assessments, audits, and reviews.

companyName: EASTERN CO

ticker: EML


text: The Audit Committee and the Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. Senior leadership, including our CIO, briefs the Board of Directors and the Audit Committee on cybersecurity risks and the effectiveness of our cybersecurity program as part of updates on our overall ERM program. Our head of Internal Audit also provides the Audit Committee with an assessment of any material changes to cybersecurity risks and controls as a result of cybersecurity threats on at least a semi-annual basis.

companyName: Installed Building Products, Inc.

ticker: IBP


text: Additionally, we have an Extended Cyber Crisis Response Team ("ECCRT"), which is a cross-functional team comprised of senior leaders that, in the event of a cyber incident, help lead the decision-making process for the execution of containment and recovery processes and incident communications, including reporting to senior management and, in turn, the Board, as appropriate, in each case in accordance with the protocols set forth in our Response Process.

companyName: Cencora, Inc.

ticker: COR


text: Although we believe we have systems and processes in place to protect against risks associated with cybersecurity incidents in the future, depending on the nature of an incident, these protections may not be fully sufficient. We, or the business partners or services providers on which we rely, have experienced cybersecurity incidents in the past that have resulted in disruptions, technology failures, or unauthorized persons gaining access to certain information systems, and we could in the future experience similar incidents. As of the date of this Form 10-K, no cybersecurity incident or attack, or any risk from cybersecurity threat, has materially affected or has been determined to be reasonably likely to materially affect the Company, our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned. For further discussion of the risks associated with cybersecurity incidents, see "A failure of any of our information systems or those of our third-party service providers, or a data security breach with regard to personally identifiable information ("PII") about our customers or employees, could have a material adverse effect on our business, results of operations, financial condition and cash flows." beginning on page 27 of the section entitled "Item 1A. Risk Factors" in this Form 10-K.

companyName: ASBURY AUTOMOTIVE GROUP INC

ticker: ABG


text: Although the risks from cyber threats have not materially affected FirstEnergy's or FET's business strategy, results of operations, or financial condition to date, FirstEnergy continues to closely monitor cyber risk. Overall, FirstEnergy has implemented tactical processes for assessing, identifying, and managing material risks from cyber security threats to FirstEnergy including governance at the executive and board level of FirstEnergy's Cyber Security Program, including FE's risk management strategy and the controls designed to protect its operations. Additionally, FirstEnergy, through its Disclosure Committee, has updated its disclosure controls and procedures to ensure appropriate disclosure of any material cyber security incidents. See Item 1A. Risk Factors for additional information regarding FirstEnergy's or FET's cyber security risks. Those sections of Item 1A. Risk Factors should be read in conjunction with this Item 1C. Cybersecurity.

companyName: FirstEnergy Transmission, LLC


text: Our cyber posture, policies and in-production procedures are designed and developed to manage and minimize risk, threat, or loss to business processing, business objectives and business assets as well as protecting the integrity, confidentiality and personal identifying information ("PII") of our employees and partners.

companyName: Southland Holdings, Inc.

ticker: SLND


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2023, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: As of the date of this Report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have, or are likely to, materially affect us since our initial public offering.

companyName: Mountain Lake Acquisition Corp.

ticker: MLAC


text: The IT Operations team is primarily responsible for the timely identification, review, severity assessment and management of cybersecurity incidents. In the event of a cybersecurity incident, the IT Department leadership follows the procedures outlined in our Cybersecurity Incident Response Policy and works closely with management to form a Security Incident Response Team comprised of members from the appropriate functional teams. In accordance with this policy, senior management will also communicate the occurrence of any significant cybersecurity incidents to our Board of Directors, Audit Committee and auditors on a timely basis and will keep them informed of the remediation plans and progress.

companyName: Cytosorbents Corp

ticker: CTSO


text: Our Board, through the Audit Committee, oversees our enterprise-wide approach to risk management, including the risks arising from cybersecurity threa ts. Our Audit Committee regularly receives presentations and reports on cybersecurity risks, which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, our Audit Committee discusses our Company's approach to cybersecurity risk management with management.

companyName: REPUBLIC AIRWAYS HOLDINGS INC.

ticker: RJET


text: Our Risk Committee, which includes our CEO and other members of management, meets quarterly as part of the Company's enterprise risk management program, with cybersecurity being the most significant area of review and reporting.

companyName: Teads Holding Co.

ticker: TEAD


text: From time-to-time, the Company has identified cybersecurity threats and cybersecurity incidents that require the Company to make changes to its processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected the Company, it is possible that threats and incidents the Company identifies in the future could have a material adverse effect on its business strategy, results of operations and financial condition.

companyName: ALERUS FINANCIAL CORP

ticker: ALRS


text: The Company's Board of Directors administers cybersecurity risk oversight primarily through its Audit Committee. The Board's Audit Committee is tasked with oversight responsibility for the Company's enterprise risk management program, including those related to cybersecurity and cyber risks. The Audit Committee receives regular reports from the Chief Financial Officer on, among other things: the Company's cybersecurity risks and threats; the status of projects to strengthen the Company's information security systems; internal and third-party assessments of the Company's cybersecurity program; and the emerging threat landscape. The Audit Committee also receives updates on any cybersecurity incidents experienced by third-party business partners that may pose significant risk to the Company. The Audit Committee provides periodic reporting to the Board of Directors on cybersecurity matters. The Company's IT and risk management departments report directly to the Chief Financial Officer and are directed to immediately report any incidents to the Chief Financial Officer. The Chief Financial Officer also apprises the Audit Committee of cybersecurity incidents consistent with the Company's incident response procedures for more significant incidents and in the aggregate for less significant incidents.

companyName: Apple Hospitality REIT, Inc.

ticker: APLE


text: Our Director of Cybersecurity is informed of any cybersecurity incidents by applicable personnel, and oversees remediation efforts in accordance with our processes. Our Chief Information Officer reports to our Audit Committee on significant incidents periodically. Our Director of Cybersecurity has over 20 years of experience as a cybersecurity and information technology professional and holds the Certified Information Systems Security Professional designation.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: As of the date of this report, we do not believe that risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. That said, as discussed more fully under Item 1A. "Risk Factors—Operational Risks— Increased information technology security threats and more sophisticated computer crime pose a risk to our systems, networks, products and services" of this Form 10-K, these threats pose a risk to the security of our systems and networks and the confidentiality, availability and integrity of our data. Cybersecurity attacks could also include attacks targeting customer data or the security, integrity and/or reliability of the hardware and software installed in Caterpillar products. It is possible that our information technology systems and networks, or those managed or provided by third parties, could have vulnerabilities, which could go unnoticed for a period of time. While various procedures and controls have been and are being utilized to mitigate such risks, there can be no guarantee that the actions and controls we have implemented and are implementing, or which we cause or have caused third-party service providers to implement, will be sufficient to protect and mitigate associated risks to our systems, information or other property.

companyName: CATERPILLAR FINANCIAL SERVICES CORP


text: As of December 31, 2024, we were not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: We address third-party cybersecurity risks presented by our use of third-party software, service, data and technology providers, including cloud-based services, and proactively evaluate the cybersecurity risk of third parties using multiple evaluation factors which are aligned with our contracting and vendor selection processes. We actively work with internal partners to assess and implement methods of transferring risk to appropriate parties.

companyName: TYSON FOODS, INC.

ticker: TSN


text: Our Chief Financial Officer meets on a periodic basis with the Audit Committee to discuss management's ongoing cybersecurity risk management procedures. Such discussions address, among other things, the sources and nature of cyber-security risks we face, how management assesses likelihood and severity of the impact of such risks, and progress on any active projects as well any current developments in the cybersecurity landscape. At the Audit Committee's discretion, material findings may be escalated to the entire board of directors.

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: We periodically engage both internal and external auditors and consultants to assess and enhance our program. These independent external auditors and consultants are accredited under various information security standards, including those administered by the International Organization for Standardization and the PCI Security Council. These engagements typically include penetration testing, third-party certifications, compliance assessments, audits, and assessments of vulnerabilities and emerging threats. We also periodically deploy our Internal Audit processes to conduct additional reviews and assessments. We also share and receive threat intelligence with government agencies, cyber analysis centers and cybersecurity associations.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: The Company's systems and processes have been, and will likely remain, subject to cyber threats and cyber-attacks and other intrusions. These threats and attacks are occurring with greater frequency and sophistication, and include ransom attacks, unauthorized access, misuse, denial-of-service attacks, system failures and disruptions. While these cyber threats and attacks have not resulted in a material adverse effect on the Company, a future cyber incident involving breach of the Company's information systems or the information systems of a third-party vendor or services provider could adversely affect the Company's business strategy, results of operations or financial condition by exposing the Company to substantial costs and negative consequences, including the loss of funds, costs of investigation and remediation, lost revenues, and reputational damage.

companyName: OLD REPUBLIC INTERNATIONAL CORP

ticker: ORI


text: We monitor our environments to identify cybersecurity threats, as well as assess our environments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Atara Biotherapeutics, Inc.

ticker: ATRA


text: Our Vice President of Information Technology, who works closely with and supervises our IT security leader, has overall responsibility for assessing and managing any material risks from cybersecurity threats. Our IT security leader has significant experience in the field and holds cybersecurity certifications from leading cybersecurity training and research institutes.

companyName: Enovis CORP

ticker: ENOV


text: The Risk and Compliance Oversight Committee of our Board of Directors (the "RCOC") is responsible for overseeing and reviewing AppFolio's cybersecurity program and cybersecurity risk exposure and the steps taken to monitor and mitigate such exposure. The RCOC updates the full Board of Directors on cybersecurity matters as appropriate.

companyName: APPFOLIO INC

ticker: APPF


text: Cybersecurity is part of our Board of Directors' oversight function. Our Board of Directors has delegated oversight of cybersecurity and other information technology to its Audit Committee. Our Audit Committee receives regular reporting from executive management on our cybersecurity risks and, as necessary, updates on cybersecurity incidents. Our Audit Committee and executive management report to our Board of Directors regarding its activities, including the Cybersecurity Program. Our Board of Directors also receives continuing education on the cybersecurity risks that impact public companies.

companyName: Spok Holdings, Inc

ticker: SPOK


text: We maintain cybersecurity policies that articulate Danaher's expectations and requirements with respect to topics such as acceptable use of technology and data, data privacy, risk management, education and awareness and event and incident management. We regularly conduct exercises, with the support of outside domain experts, to improve the effectiveness of our processes and we periodically assess our processes against recognized cybersecurity frameworks. Consistent with our position that cybersecurity is the responsibility of every Danaher associate, we regularly educate and share best practices with our associates to raise awareness of cybersecurity threats. Every year, associates in applicable job categories are required to take information security and protection training as part of the Danaher Annual Training Program. We also conduct regular education and training for our associates through cyber-event simulations.

companyName: DANAHER CORP /DE/

ticker: DHR


text: Cybersecurity Risk Strategy We drive an aggressive cybersecurity roadmap aligned to internationally recognized cybersecurity frameworks and focused on evolving global threats, new cybersecurity insurance requirements and continuous improvement of incident response. Our cybersecurity program is aligned with the NIST Cybersecurity Framework and we also maintain ISO 27001 certification. Pursuant to the framework, we utilize industry leading cyber solutions and techniques to prevent, detect, and respond to incidents using a layered security model. We conduct an annual gap assessment against the NIST Cybersecurity Framework, the results of which are used to establish goals and measure progress against our cybersecurity roadmap. Based on the gap assessment, for example, we have taken a number of actions intended to reduce our cybersecurity risk, including implementing network segmentation, enhancing our email and end-point security programs and improving our web application filtering programs. We are focused on the continuous improvement of key processes such as asset management, access control, vulnerability management, incident response, and third-party risk management. We also maintain business continuity management certification to ensure the ongoing review of our business continuity, disaster recovery and incident management processes, including as a result of a cybersecurity breach.

companyName: Ribbon Communications Inc.

ticker: RBBN


text: Third Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third party systems. Third parties are granted access to systems based on the principle of least privilege.

companyName: BADGER METER INC

ticker: BMI


text: Our Technology Risk and Information Security (TRIS) program, which is our enterprise information security and cybersecurity program incorporated in our ERM program and led by our Chief Information Security Officer (CISO), is designed to (i) ensure the security, confidentiality, integrity and availability of our information and information systems; (ii) protect against any anticipated threats or hazards to the security, confidentiality, integrity or availability of such information and information systems; and (iii) protect against unauthorized access to or use of such information or information systems that could result in substantial harm or inconvenience to us, our colleagues or our customers. The TRIS program is built upon a foundation of advanced security technology, employs a highly trained team of experts and is designed to operate in alignment with global regulatory requirements. The program deploys multiple layers of controls, including embedding security into our technology investments, designed to identify, protect, detect, respond to and recover from information security and cybersecurity incidents. Those controls are measured and monitored by a combination of subject matter experts and a security operations center with integrated cyber detection, response and recovery capabilities. The TRIS program includes our Enterprise Incident Response Program, which manages information security incidents involving compromises of sensitive information, and our Cyber Crisis Response Plan, which provides a documented framework for handling high-severity security incidents and facilitates coordination across multiple parts of the Company to manage response efforts. We also routinely perform simulations and drills at both a technical and management level, and our colleagues receive annual cybersecurity awareness training.

companyName: AMERICAN EXPRESS CO

ticker: AXP


text: Due to the size of the Company, we have not yet developed robust policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We and our subsidiaries currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems, including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. We rely on third party providers and outsourced IT services to monitor and address cybersecurity related risks, including installing software for threat protection and malware. Such third party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our board of directors to discuss if deemed necessary or appropriate.

companyName: SinglePoint Inc.

ticker: SING


text: The Company is subject to various cybersecurity risks that could impact our systems and our ability to operate. We have developed processes to assess, identify and manage our risks related to cybersecurity threats which are incorporated into the Company's overall risk management process. On an ongoing basis we utilize threat prevention systems to monitor, block and protect our information technology systems which are monitored continuously by trained security personnel. Our process to prevent cybersecurity incidents involves layered security architecture to protect our networks, end-user devices, servers, and cloud solutions. On a regular basis, we conduct phishing email simulations and provide training resources to our employees. We have an Incident Response Plan to outline our process to manage cybersecurity threats and incidents. We utilize industry recognized security and compliance experts for regular security assessments. In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we review their compliance against internationally recognized standards.

companyName: Hamilton Beach Brands Holding Co

ticker: HBB


text: The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: Via Renewables, Inc.

ticker: VIASP


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with industry recognized IT providers leveraging third-party technology and expertise. These third-party service providers are a key part of our current cybersecurity risk management and provide services including, maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts, network integrity safeguarded by employing web-based software, including endpoint protection, endpoint detection and response, and remote monitoring management on all devices, industry-standard encryption protocols and critical data backups. Our outsourced information technology consultant conducts proactive patching and monitoring of all of our existing systems and has implemented systems and procedures to mitigate cybersecurity risks that we believe are appropriate for a company of our size, stage of growth and financial condition. In addition, we carry insurance with coverage for cyber events that we believe is suitable for a company of our size, stage of growth and financial condition.

companyName: Virpax Pharmaceuticals, Inc.

ticker: VRPX


text: As of the date of the filing of this Annual Report, we have not encountered any cybersecurity incidents that have materially impaired our business strategy, operations or financial standing.

companyName: FTC Solar, Inc.

ticker: FTCI


text: The President and COO, with guidance from our third-party managed services provider and CIO consulting firm, manages our cybersecurity risk management and strategy process. Collectively, our consultants have 50+ years' experience in the cybersecurity industry in various roles.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: The Audit Committee is responsible for overseeing our cybersecurity threat risks and receives updates during its quarterly meetings from our Director of Cybersecurity and IT Governance. At each meeting, the Audit Committee is briefed on matters pertaining to our exposure to material privacy and cybersecurity risks, as well as risks that are deemed to have a moderate or higher business impact, even if immaterial. The Director of Cybersecurity and IT Governance also routinely briefs senior management on such matters as they arise.

companyName: Core Laboratories Inc. /DE/

ticker: CLB


text: Our management team also engages, at times when needed, certain outside advisors and consultants to assist in the identification, oversight, evaluation and management of cybersecurity risks, as well as to advise on specific topics. As part of our overall risk mitigation strategy, the Company also maintains cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches.

companyName: NETSOL TECHNOLOGIES INC

ticker: NTWK


text: We depend on digital technologies, including information systems, infrastructure and cloud applications and services, including those of third parties with which we may deal. Sophisticated and deliberate attacks on, or security breaches in, our information systems or infrastructure, or the information systems or infrastructure of third parties or the cloud, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with the cybersecurity incident. As an early stage company without significant investments in data security protection, there can be no assurance that we will have sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have adverse consequences on our business and lead to financial loss.

companyName: Red Rock Acquisition Corp.


text: We use third-party service providers to perform a variety of functions throughout our business, such as providing cloud-based infrastructure, hosting third party applications, and delivering content to customers, as well as data center hosting. We have a formal vendor management program to manage cybersecurity risks associated with our use of these providers. The security organization conducts a risk assessment to determine the criticality of the vendor prior to onboarding. Depending on the criticality of the vendor–which is based on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider–our vendor security review process involves different levels of assessment designed to identify cybersecurity risks associated with a provider prior to onboarding and on a periodic basis, including, for example: (1) a vendor security questionnaire; (2) results of audit reports and certifications; and (3) policies and standards detailing the third-party's security program. Based on the results of the vendor security review, a decision is made on whether the third-party can be engaged. We review our most critical providers' audit reports and certifications on an annual basis to reassess whether or not they have experienced any material changes or degradations to their security programs since our initial review that may warrant re-evaluation. The Company generally engages reputable third-party service providers and when appropriate, imposes contractual obligations related to cybersecurity on its providers.

companyName: Fastly, Inc.

ticker: FSLY


text: A key component of our enterprise risk management program is our incident response plan, which provides for controls and procedures in connection with cybersecurity incidents. Under this plan, we have established a cybersecurity incident command, a multi-disciplinary management-level team led by the CISO. The plan provides that the incident response team will conduct an initial assessment in the event of a cybersecurity incident meeting certain criteria elevated for the review of senior members of the cybersecurity team. In such event, the plan provides that the incident response team will assess whether a cybersecurity incident has the potential to materially impact the organization and whether public disclosure is required or advisable in connection therewith, and further provides that, if appropriate, any such cybersecurity incident may be further elevated for the review of senior management, the Audit and Compliance Committee and/or the Board of Directors.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: Our senior management team conducts the regular assessment and management of material risks from cybersecurity threats, including review with our information technology team and third-party service providers. All employees and consultants are directed to report to our senior management any irregular or suspicious activity that could indicate a cybersecurity threat or incident. The Audit Committee of our Board of Directors evaluates our cybersecurity assessment and management policies, including quarterly discussions with our senior officers and independent registered accounting firm.

companyName: Lantern Pharma Inc.

ticker: LTRN


text: The Company understands the critical importance of developing, implementing, and maintaining robust cybersecurity measures to protect our information systems and ensure the confidentiality, integrity, and availability of our data that is created, collected, stored, and used to operate our business.

companyName: UNIVERSAL INSURANCE HOLDINGS, INC.

ticker: UVE


text: While some of the Company's third-party service providers have experienced cybersecurity incidents and the Company has experienced threats to its data and systems, as of the date of this report, the Company's management is not aware of any cybersecurity threats or incidents that have materially affected its business strategy, results of operations, or financial condition. This does not guarantee that future incidents or threats will not have a material impact by interrupting operations, causing reputational harm, increasing operating costs, or exposing the Company to litigation. For additional commentary on cybersecurity risks, see Part 1, Item 1A. Risk Factors under the heading "The Company may be adversely impacted if the Company is affected by cybersecurity attacks, security breaches, or other IT interruptions, involving its own systems or those with whom it does business."

companyName: HORMEL FOODS CORP /DE/

ticker: HRL


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threats alongside other company risks as part of our overall risk assessment process. In addition, we perform an external, specific cybersecurity risk assessment every eighteen months. Included in our management of cybersecurity risk is our bi-annual review of our Incident Response Plan/Policy, involving employees from all responsibility levels of the company. Our Chief Financial Officer has primary responsibility for overseeing our information systems and information technology resources, including risks from cybersecurity threats. To assist our Chief Financial Officer in discharging these responsibilities, we have a standing management committee to address information technology and cybersecurity risk matters comprised of our Chief Financial Officer, the principal of a third-party, managed security service provider (an "MSSP"), our Vice President of Risk Management, our Chief Accounting Officer, our Senior Vice President of Human Resources and certain other members of our information technology staff and property management. The members of this committee meet on a quarterly basis, with additional full or sub-committee meetings held as-needed throughout the year, to: • monitor emerging data protection laws and implement changes to our processes designed to comply with these laws; • identify and assess material risks from cybersecurity threats; • provide guidance on our cybersecurity strategy development and implementation; • ensure that regular risk assessments and appropriate mitigation strategies are in place; • ensure the performance of regular vulnerability and penetration testing and remediation of findings; • oversee the implementation and management of cybersecurity-related tools such as security information and event management systems; • review relevant service organization controls reports for the MSSP that serves as our Security Operation Center; and • require training and security awareness programs for our employees.

companyName: Piedmont Realty Trust, Inc.

ticker: PDM


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: Telomir Pharmaceuticals, Inc.

ticker: TELO