text: As a component of and integrated into our overall risk management strategy and system, we maintain a cybersecurity risk management program designed to assess, identify, manage and protect our information systems and data from unauthorized access, use, disclosure, disruption, modification or destruction. Our program is based on applicable industry frameworks and standards, including those provided by the National Institute of Standards and Technology, and is comprised of core functions to identify, protect, detect, respond to and recover from cybersecurity threats and events. We constantly monitor cybersecurity threats and test the performance and effectiveness of our cybersecurity program, with the assistance of third-party experts, on an annual and ongoing basis. We recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough security assessments of these third-party engagements and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual and ongoing assessments. As described in "Item 1A. Risk Factors" in this Form 10-K, we are subject to risks from cybersecurity threats that could have a material adverse impact on our business and financial results. As of the date of this report, no risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business, results of operations, financial condition and cash flows.

companyName: INSTEEL INDUSTRIES INC

ticker: IIIN


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from security incidents were immaterial. As a result, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, our results of operations and financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. See "Risk Factors — Risks Related to Privacy and Security." As cybersecurity threats become more frequent, sophisticated and coordinated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures as we pursue our strategy that includes developing and commercializing products that integrate our CGM technologies into insulin delivery systems or data platforms of our partners. The technology integration and cloud-based depository platforms we continue to focus on can make us more vulnerable to cybersecurity threats, thereby making our pursuit of such strategies more costly.

companyName: DEXCOM INC

ticker: DXCM

secItem: Item 1C


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example threat intelligence service providers and dark web monitoring services.

companyName: Rani Therapeutics Holdings, Inc.

ticker: RANI


text: The design of Matson's vessel and office information technology systems is informed in part by the following third-party frameworks or standards: NIST Cybersecurity Framework NIST 800-171 DFARS 252.204-7012

companyName: Matson, Inc.

ticker: MATX


text: Risk Identification and Assessment We have a dedicated InfoSec team that regularly reviews threat intelligence from various sources, including third-party InfoSec consultants, assesses the applicability of known threats and threat actor behavior and tactics to the Company, and assesses whether these threats pose risks to the Company. The InfoSec team then evaluates potentially appropriate administrative, technical, and physical controls to mitigate and reduce these risks within the appropriate business context and applies such controls where appropriate. We also have implemented a process to identify and mitigate risks from cybersecurity threats related to our use of third-party service providers.

companyName: RECURSION PHARMACEUTICALS, INC.

ticker: RXRX


text: Physical Security The Company safeguards assets through a standard physical security design process, including access controls, surveillance and monitoring, perimeter security controls, data center security, and incident response and reporting controls.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: Additionally, Dow engages in cyber crisis response simulations to assess Dow's ability to adapt to information and operational technology threats. Improper or illegitimate use of Dow's information system resources or violation of Dow's information security policies and procedures is subject to disciplinary action. Dow's security posture is supported by a comprehensive defense-in-depth strategy that relies on layers of technology including Multi-Factor Authentication and principles of Zero Trust to ensure that access to information and communication is vetted and secure.

companyName: UNION CARBIDE CORP /NEW/


text: The Company's cyber risk management strategy has consisted of a focus on minimizing our attach surface and leveraging industry standard cyber threat prevention, detection, and remediation tools.

companyName: REGENEREX PHARMA, INC.

ticker: RGPX


text: For further discussion of risks from cybersecurity threats, see the section captioned "Risks Related to Information Technology and Cybersecurity" in Item 1A. Risk Factors.

companyName: Freedom Holding Corp.

ticker: FRHC


text: We engage consultants in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our business."

companyName: Amphastar Pharmaceuticals, Inc.

ticker: AMPH


text: The Bank has a Business Continuity Program that sets forth the actions that would be taken to recover business processes in a timely manner in the event of a disruption. The Bank regularly tests its Business Continuity Plan to ensure its relevance and viability. Representatives from the Bank's Business Continuity team work closely with the Bank's business units and IT to help ensure that critical resources are available in the event of an interruption. To ensure its preparedness, the Bank updates its Business Continuity Plan semiannually. In addition, the Bank evaluates and analyzes threat scenarios, and it conducts periodic exercises to demonstrate the Bank's ability to run production systems from an alternate location and to seamlessly return to using production systems at its primary operations centers.

companyName: Federal Home Loan Bank of Dallas


text: To date, we have not (to our knowledge) encountered cybersecurity challenges that have materially affected our business strategy, results of operations, or financial condition.

companyName: Lifeloc Technologies, Inc

ticker: LCTC


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Aligos Therapeutics, Inc.

ticker: ALGS


text: We have robust firewalls for all access points. We have top line anti-virus on all computers and networks. We have prioritized the risks to protect our networks. To protect our departments we have implemented an architecture of a separate network for administration and one for engineering. This gives redundancy and protection. There is onsite as well as offsite backup as well as a separation of WiFi for visitors to prevent access to our network.

companyName: ADM TRONICS UNLIMITED, INC.

ticker: ADMT


text: The Company engages in cyber crisis response simulations to assess the Company's ability to adapt to information and operational technology threats. Improper or illegitimate use of the Company's information system resources or violation of the Company's information security policies and procedures is subject to disciplinary action. The Company's security posture is supported by a comprehensive defense-in-depth strategy that relies on layers of technology including Multi-Factor Authentication and principles of Zero Trust to ensure that access to information and communication is vetted and secure.

companyName: Cohen & Co Inc.

ticker: COHN


text: Our information security management system is based upon industry frameworks. Our Chief Information Security Officer (CISO) leads our cybersecurity program, which includes the implementation of controls designed to align with these industry frameworks and applicable statutes and regulations. Our CISO has over 30 years of prior work experience in various roles involving managing information security programs, developing cybersecurity strategy, implementing effective information and cybersecurity initiatives and has been the Head of IT Audit, CISO and CIO at three other companies prior to Gen Digital. He has a Bachelor of Science in Computer Information Systems. We have implemented security monitoring capabilities designed to alert us to suspicious activity and developed an incident response program that includes periodic testing and is designed to restore business operations quickly. In addition, employees participate in mandatory annual training and receive communications regarding the cybersecurity environment to increase awareness throughout the company. We also implemented an enhanced annual training program for specific specialized employee populations, including secure coding training.

companyName: Gen Digital Inc.

ticker: GEN


text: Our networks and systems are continuously monitored by a combination of third-party service providers and an internal cybersecurity team. Management is promptly notified of cybersecurity incidents. Audit Committee is promptly notified by our management of any material cybersecurity breach. Board of Directors is briefed at least quarterly on the state of our cybersecurity program.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: The Board of Directors has delegated oversight of cybersecurity risk management to the Audit Committee. The Audit Committee reviews the Company’s major cybersecurity risk exposures and the steps that the Company’s management has taken to monitor and control such exposures. Specifically, the Audit Committee reviews reports on data management, security initiatives, and significant existing and emerging cybersecurity risks, including material cybersecurity incidents, the impact on the Company and its stakeholders of any significant cybersecurity incident, and any disclosure obligations arising from any such incidents.

companyName: Metagenomi Therapeutics, Inc.

ticker: MGX


text: The Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. Board also receives briefings from management on our cybersecurity risk management program.

companyName: Hapi Metaverse Inc.


text: Following our risk assessments, we design and implement reasonable safeguards to address any identified gaps in our existing processes and procedures. Our employees participate in cybersecurity training and awareness upon hire and at least annually thereafter.

companyName: Block, Inc.

ticker: XYZ


text: TVA's current VP, Cybersecurity serves as Chief Information Security Officer ("CISO"). The current CISO is also designated as the Chief Artificial Intelligence Officer and the agency's Federal Senior Intelligence Coordinator. Starting in operational technology as part of nuclear generation, the current CISO has spent his career in public power in various North American Electric Reliability Corporation regions and has been in the industry for over 25 years. He has led Cybersecurity for over 10 years in the sector. He was previously the CISO of the New York Power Authority, and he has experience supporting all verticals of electric operations, from the perspectives of security, resiliency, and recovery. He is a Certified Information Security Manager and has previously held Chair and Co-chair roles in the industry, such as with the Electric Subsector Coordinating Council's Cyber Mutual Aid Committee. He seeks to focus on information sharing and building partnerships to enable understanding of emerging threats. The current CISO remains active in various security organizations and the broader industry. He has a degree in Computer Science and a Master of Business Administration.

companyName: Tennessee Valley Authority

ticker: TVE


text: The Board, the Audit Committee and management each actively assess the Company's cybersecurity and data privacy risk management practices with the goal of being proactive rather than reactive. The Board and the Audit Committee regularly review the Company's cybersecurity and data privacy risks, including our policies, controls and procedures for identifying, managing and mitigating such risks. The Audit Committee receives periodic reports from our Chief Information Security Officer ("CISO") and other members of management, to the extent their relevant areas are impacted, regarding cybersecurity and data privacy measures and procedures, the identification of security gaps and compliance with applicable cybersecurity and data privacy regulations. The Audit Committee then briefs the Board at scheduled meetings about cybersecurity and data privacy developments.

companyName: Wheels Up Experience Inc.

ticker: UP


text: The Audit Committee is tasked with overseeing our risks related to cybersecurity, including reviewing the state of our cybersecurity, emerging cybersecurity developments and threats, and our strategy to mitigate cybersecurity risks. From time to time, members of our executive management team and our directors of Information Technology and Internal Audit provide updates to the Audit Committee and the Board of Directors regarding cybersecurity incidents and cybersecurity planning.

companyName: Montauk Renewables, Inc.

ticker: MNTK


text: Our cybersecurity policies and procedures encompass data privacy, incident response, information security and risks from our use of third-party vendors. In order to help develop these policies and procedures, we monitor the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business, as well as proposed privacy and cybersecurity laws, regulations, guidance and emerging risks.

companyName: Civeo Corp

ticker: CVEO


text: The AEOC, which is comprised entirely of independent directors, is responsible for periodically reviewing and assessing with management (i) the adequacy of controls and security for our information technology systems, processes and data, and (ii) our contingency plans in the event of a breakdown or security breach affecting our information technology systems, it being understood that it is not possible to eliminate all such risks and that we will necessarily face a variety of risks with respect to information technology in the conduct of our business. The AEOC is additionally responsible for reviewing the cybersecurity disclosures required to be included in our filings with the SEC.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, malicious attacks, improper employee or contractor access, harm to employees or customers and violation of data privacy, intellectual property or security laws. Although, as of the date of this Form 10-K, Huron has not experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Further details about the cybersecurity risks we face are described under Item 1A. "Risk Factors."

companyName: Huron Consulting Group Inc.

ticker: HURN


text: Our cybersecurity program is managed by a global internal team that addresses potential risks, implements processes to support our cybersecurity program and responds to potential cyber incidents. The team has decades of experience with varied certifications and includes our Senior Director of IT who has over 20 years of experience as an IT professional engaged in network architecture and cybersecurity. The internal team is supported by third party providers to expand coverage, expertise and responsiveness.

companyName: ESCO TECHNOLOGIES INC

ticker: ESE


text: Governance Related To Cybersecurity Risks Our cybersecurity process is overseen by our Information Technology department, which is managed by our Head of IT. The Head of IT role is currently held by an individual who has approximately two decades of professional IT management experience. In addition, our Security Leadership Team (SLT), which is comprised of the Head of IT as well as leaders from our operations, finance, and legal departments, is responsible for documenting, reviewing, and assessing our cybersecurity processes, monitoring for cybersecurity incidents, and periodically reporting on cybersecurity risks and risk management to a committee of our executive team (Executive Committee). The Executive Committee, which is led by our Chief Financial Officer, undertakes reviews of our cybersecurity program and assesses any security incident updates from the SLT on a quarterly basis.

companyName: FATE THERAPEUTICS INC

ticker: FATE


text: The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives periodic briefings from management on our cyber risk management program. Board of Directors members receive presentations on cybersecurity topics from a combination of our CDIO, CISO, Deputy General Counsel, internal security staff, external counsel or external experts, as part of the Board of Director's continuing education on topics that impact public companies.

companyName: AMERICAN AIRLINES, INC.


text: This program addresses cybersecurity risks to the corporate information technology ("IT") environment including systems, hardware, software, data, people, and processes.

companyName: Arena Group Holdings, Inc.

ticker: AREN


text: In addition, our internal audit function integrates the assessment and identification of cybersecurity-related risks into our annual overall enterprise risk assessment ("ERA"). The ERA process is designed to assess and identify the key risks that management believes could adversely impact our business operations or impede the achievement of our business objectives, which includes an assessment of our cybersecurity program and the cybersecurity-related risks that we face. To the extent the ERA identifies a heightened cybersecurity-related risk(s), we have implemented a process for the risk(s) to be presented to the Audit Committee and the full Board of Directors, as appropriate.

companyName: BXP, Inc.

ticker: BXP


text: Various management committees exist including the Information Security Committee, which focuses on technology risk, controls and the information security program. This committee provides oversight and governance of the information security program and technology risks. This committee is chaired by the Chief Information Security Officer and includes other executives across the Bank, including the Chief Information Officer and Chief Technology Officer. This committee meets quarterly to provide oversight of information security projects and services including strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks.

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: Our CISO, who has extensive cybersecurity knowledge and skills gained from extensive information technology and engineering experience, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business. The CISO receives reports on cybersecurity threats from other internal information security personnel on an ongoing basis and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate cybersecurity risks. The CISO also attends meetings of the board of directors to report on any material developments. We have protocols by which certain cybersecurity incidents are reported promptly to management and the legal team.

companyName: MAGNITE, INC.

ticker: MGNI


text: In addition, the CIO, CISO, General Counsel and certain other members of senior management meet periodically with the audit, risk, and legal and regulatory committees of the board of directors to review our information technology and cybersecurity risk profile and to discuss risk mitigation plans. While the board risk committee is ultimately responsible for overseeing the management of our information security program at the board level, the audit and legal and regulatory committees assist the risk committees in fulfilling its duties. Each of the board committees regularly briefs the full board of directors on matters reported to them. See Item 10. Directors, Executive Officers and Corporate Governance—Corporate Governance—Risk Management Oversight for additional information regarding the role of our board of directors in risk management oversight, including its oversight of risks from cybersecurity threats. We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. See Item 1A. Risk Factors—Risks Relating to Our Business Operations—Interruption or other operational failures in telecommunications, information technology and other operational systems, including as a result of threat actors attacking those systems, or a failure to maintain the security, integrity, confidentiality or privacy of sensitive data residing on those systems, including as a result of human error, could have a material adverse effect on our business and Item 1A. Risk Factors—Risks Relating to Our Relationship with Apollo—Interruption or other operational failures in telecommunications, information technology and other operational systems at Apollo or a failure to maintain the security, integrity, confidentiality or privacy of sensitive data residing on Apollo's systems, including as a result of human error, could have a material adverse effect on our business for further discussion of the risks we face from cybersecurity threats.

companyName: Athene Holding Ltd.

ticker: ATH-PA


text: Management of risks, including risks of cybersecurity threats, is delegated to the Company's Associate Vice President (AVP) of IT Infrastructure and Security. This leader reports administratively to the Vice President of Technology and has informal reporting relationships with the General Counsel and Chief Audit Executive. The AVP of IT Infrastructure and Security has over 25 years of information technology and security experience and are responsible for the day-to-day information security program objectives. They are also responsible for attending quarterly Audit Committee meetings and reporting results of the cybersecurity program to the Audit Committee, including results of preventative activities (e.g. endpoint protection, security training), ongoing monitoring activities (e.g., vulnerability testing), and remediation activities (e.g., issues identified through audits and assessment activities).

companyName: NeueHealth, Inc.

ticker: NEUE


text: The Information Security Program is led by the Chief Information Security Officer ("CISO"), who reports to the Chief Risk Officer. The Chief Risk Officer has oversight of the Company's risk management framework, which includes the Information Security Program. The CISO provides program oversight and direction, including adjustments in response to changes in technology, threats, business processes, and regulatory or statutory requirements. The CISO works collaboratively with information technology staff, operational management, and functional stakeholders to implement a program designed to protect our information systems from cybersecurity threats and promptly respond to potential cybersecurity incidents. The CISO has over 25 years of experience in the fields of information technology and cybersecurity, most at a Fortune 500 global technology company, and maintains multiple professional cybersecurity certifications.

companyName: HOME BANCSHARES INC

ticker: HOMB


text: The expertise of key members of management and our committees responsible for assessing, managing, and presenting quarterly updates to the Board's Risk Committee about our cybersecurity risks is summarized as follows: • John Bresney, EVP & CIO, reports directly to our Chief Executive Officer and is responsible for all of our IT operations, including oversight of the SVP of Enterprise Strategy and Execution's implementation of our cybersecurity program and enforcement of our cybersecurity policies. He has worked for us for approximately 31 years, holding various technology and information security roles of increasing responsibility. He has a bachelor's degree in information systems and business, a Master's Certificate in Project Management, and a Columbia University CIO Program Certificate. • Robert McKenna, SVP of Enterprise Strategy and Execution, reports to our CIO and leads the implementation of our cybersecurity program, enforcement of our cybersecurity policies, technology planning, projects driving IT strategy, and enterprise IT risk management. He also oversees cybersecurity incidents under our Security Incident Response Plan ("IRP"). He has worked for us for approximately 22 years in related positions of increasing responsibility and has over 28 years of technology and information security experience. He has a master's degree in business administration, a Certificate in Project Management, and is a Certified Insurance Counselor. • Christopher Cunniff, SVP and CRO, reports to our Chief Financial Officer, leads our Reinsurance and ERM teams, and chairs the ERC and the Market Security Committee. He has worked for us for approximately seven years, and he previously was our SVP of Actuarial Reserving. He has over 33 years of insurance industry experience, serving in various key leadership positions. He has a bachelor's degree in mathematics, is a fellow of the Casualty Actuarial Society, and is a member of the American Academy of Actuaries.

companyName: SELECTIVE INSURANCE GROUP INC

ticker: SIGI


text: Board Oversight of the Cybersecurity Program and Patient Privacy Matters Our board of directors has actively sought out experience and expertise among its members to further its oversight of cybersecurity risk. We believe that Messrs. Carmichael and Reidy and Ms. Herman have extensive knowledge and experience in cybersecurity oversight. Mr. Carmichael previously served as chief information officer at multiple companies, and Mr. Reidy directly supervised and oversaw the information security programs at two companies. Ms. Herman has completed the National Association of Corporate Directors' Cyber-Risk Oversight Program, which is designed to enhance cybersecurity literacy and strengthen cyber-risk oversight practices, and holds a CERT Certificate in Cybersecurity Oversight.

companyName: Encompass Health Corp

ticker: EHC


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; evaluate how to reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Vice President of Information and Business Systems who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: ESS Tech, Inc.

ticker: GWH


text: Members of Cohen & Steers' Cybersecurity Management team identify and assess risks from cybersecurity threats by monitoring its threat environment and enterprise risk profile using various manual and automated tools as well as by: (i) utilizing shared information about vulnerabilities and exploits from professional security organizations, reports or other services that identify cybersecurity threats and through the use of external intelligence feeds; (ii) analyzing reports of threats and actors; (iii) conducting periodic vulnerability scans of Cohen & Steers' IT environment; (iv) evaluating Cohen & Steers' and its industry's risk profile; (v) evaluating threats that are reported to Cohen & Steers; (vi) coordinating with law enforcement concerning threats; (vii) conducting internal and external audits of Cohen & Steers' information security control environment and operating effectiveness; and (viii) conducting threat assessments for internal and external threats, including through the use of third party threat assessments and vulnerability threat assessments.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: As part of our cybersecurity program, we regularly perform risk assessment of cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. On a bi-weekly basis, we assess cybersecurity threats through a third-party cybersecurity vendor. We use a widely adopted risk quantification model to identify, measure, and prioritize cybersecurity and technology risks and develop security controls and safeguards. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact. We conduct regular reviews and tests of our information security program, tabletop exercises, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning.

companyName: NV5 Global, Inc.


text: Security Awareness Program: We conduct regular training and testing programs to enhance the cybersecurity awareness and readiness of our personnel, empowering them to actively contribute to our cybersecurity efforts.

companyName: Whitestone REIT

ticker: WSR


text: Our program incorporates procedures for identifying the source of a cybersecurity threat or incident (including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider), assessing the severity and risk of a cybersecurity threat or incident, implementing countermeasures, and reporting significant threats to management and the board of directors.

companyName: AssetMark Financial Holdings, Inc.


text: Third-party experts assist our senior management team in assessing and managing material risks from cybersecurity threats. All employees and consultants are directed to report to our senior management any irregular or suspicious activity that could indicate a cybersecurity threat or incident. The Audit Committee of our Board of Directors evaluates our cybersecurity assessment and management policies, including quarterly discussions with our senior officers and independent registered accounting firm.

companyName: FITLIFE BRANDS, INC.

ticker: FTLF


text: We maintain a proactive cybersecurity program that is aligned with our business and is dedicated to managing information technologies ("IT") risks to our Company. We have established policies, standards, processes, and practices for assessing, identifying and managing material risks from cybersecurity threats. These measures are integrated into our overall risk management program and governance structure, demonstrating our commitment to cybersecurity in a manner consistent with our business activities.

companyName: BT Brands, Inc.

ticker: BTBD


text: We have implemented processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are designed to preserve the confidentiality, integrity, and availability of our information systems and the information residing therein. Our cybersecurity incident response plan is based on the NIST 800-61r2 "Computer Security Incident Handling Guide." This plan is used to process security events identified through our real-time, 24x7 monitoring, and is also used to conduct security incident tabletop exercises. The incident response plan includes detailed steps for incident leadership, escalation to established partners, response protocols based on the type of incident, responsibilities for follow-up and reporting, and steps to capture lessons learned and improvement opportunities. Our vulnerability management processes include real-time monitoring for vulnerabilities and standardized reporting for managing remediation efforts. Our cybersecurity risk management processes are integrated into our overall risk management system to ensure alignment with our business objectives and strategies. We engage assessors, consultants, auditors and other third parties to execute certification audits, penetration tests, and security framework risk assessments. These external entities provide specialized expertise and insights to enhance the effectiveness of our cybersecurity risk management processes.

companyName: EXPONENT INC

ticker: EXPO


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. As part of the Company's enterprise risk management process, we conduct a comprehensive annual enterprise risk assessment that includes consideration of cybersecurity risks in conjunction with other Company risks. Our cybersecurity team further evaluates cybersecurity risks and develops risk mitigation response plans. We have established internal policies and procedures for cybersecurity risk management and incident response management that are based on industry standard cybersecurity frameworks, and we provide regular training to our employees regarding evolving cybersecurity threats and risk management. We also maintain cybersecurity insurance coverage that is intended to address certain costs that we may incur in the event that we experience a cybersecurity incident.

companyName: OLAPLEX HOLDINGS, INC.

ticker: OLPX


text: As previously disclosed, we experienced a cybersecurity disruption at the end of Fiscal 2022, which did not result in a material impact to our business strategy, results of operations or financial condition. We have not experienced any material cybersecurity incidents in Fiscal 2023, and as of the date of this Report, we have not identified any material risks from active cybersecurity threats, including as a result of any prior cybersecurity incidents. However, despite our security measures, there can be no assurance that our cybersecurity risk management processes described will be fully implemented, complied with or effective in protecting our systems and information. While we maintain insurance to mitigate potential losses from a cybersecurity incident, such insurance may be insufficient to cover all losses or all types of claims that may arise. See Item 1A. Risk Factors in this Report for a discussion of whether and how risks from identified cybersecurity threats have materially affected or, if realized, are reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: Citi Trends Inc

ticker: CTRN


text: We have not, to date, experienced a cybersecurity incident which was determined to be material, although, like any technology provider, we have experienced incidents in the past. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer our security measures, our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to employee error, malfeasance or other disruptions. Any such breach could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, and regulatory penalties, disruption of our operations and the services we provide to clients, damage to our reputation, and a loss of confidence in our products and services, each of which could adversely affect our business, financial condition, results of operations and prospects," which should be read in conjunction with the information above.

companyName: Sharplink, Inc.

ticker: SBET


text: Maintaining people's trust is of paramount importance for Logitech. Logitech's security capability is designed to protect the confidentiality, integrity, availability and accessibility of Logitech's information, digital assets, products and services.

companyName: LOGITECH INTERNATIONAL S.A.

ticker: LOGI


text: Our cybersecurity program is informed by various industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework, and our security management is ISO/IEC 27001:2022 certified. Our management, with oversight from our Board, performs an annual enterprise-wide risk assessment (ERA) to identify key existing and emerging risks. One of the main risks identified and assessed annually through this process is cybersecurity and data privacy, which remains a key focus for the Company, management, and our Board.

companyName: APPLIED INDUSTRIAL TECHNOLOGIES INC

ticker: AIT


text: Disaster Recovery and Data Resiliency: We have robust backup and disaster recovery processes in place to ensure business continuity in the event of a security incident or system failure.

companyName: Korth Direct Mortgage Inc.


text: Risk assessment and management - Our corporate and product security professionals assist in managing cybersecurity systems and in preventing, detecting, assessing, and resolving cybersecurity incidents. We build cybersecurity principles into our product development and system design, we have internal and external penetration testers who test our product platform and corporate systems, and we have a bug bounty program that can incentivize external security researchers who help us identify and fix bugs and vulnerabilities before they are exploited. Our internal audit team and our company's independent auditors periodically assess the effectiveness of certain of our cybersecurity-related controls. From time to time, we also engage external consultants and advisors to perform independent security testing and assessments and to assist with aspects of our cybersecurity program. We also utilize automated technology that alerts our security team of unusual activity in our corporate systems, product platform, and public-facing systems. As part of our processes, we require applicable internal approvals for changes to security-critical aspects of our product platform and services.

companyName: Dynatrace, Inc.

ticker: DT


text: We have a dedicated security team led by our Director of Worldwide IT, who, in coordination with management, including our Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer, monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in accordance with our incident response and recovery plans. Threats and incidents that are identified as potentially significant are promptly reported to the audit committee. Our dedicated security team has over 20 years of experience in managing and monitoring corporate cybersecurity programs.

companyName: PIXELWORKS, INC

ticker: PXLW


text: Internal and third-party risks are reviewed, monitored and managed by the Company's IT ISC2, SANS, CompTIA certified security partners and external expert consultants. The Company annually engages third-party experts to assess the effectiveness of system and network security. Periodically, an external independent consultancy team conducts a comprehensive review of the Company's cybersecurity program using the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Additionally, the Company is assessed annually by an independent third party for compliance with the PCI-DSS standard, for which the Company receives an attestation of compliance.

companyName: BRAND HOUSE COLLECTIVE, INC.

ticker: TBHC


text: The head of our information security team (Svai Sanford, Chief Financial Officer ("CFO")), our information security team and our legal team help identify, assess and manage our cybersecurity threats and risks. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example deploying certain automated tools, subscribing to reports and services that identify certain cybersecurity threats, conducting scans of certain threat environments, evaluating certain threats reported to us, using external intelligence feeds, and conducting vulnerability assessments in certain environments and systems to identify vulnerabilities.

companyName: Rani Therapeutics Holdings, Inc.

ticker: RANI


text: Our employees, as well as certain contractors, are required to complete cybersecurity awareness and training programs. Mandatory technical training is provided to employees and vendors performing, verifying, or managing cybersecurity activities. Mitigation efforts also include annual cyber crisis response simulations and annual training.

companyName: Talen Energy Corp

ticker: TLN


text: Policies related to cybersecurity risks are documented, reviewed annually, and published internally, which define the correct processes for identifying, containing, remediating, and responding to cybersecurity incidents. Our data protection policies define the establishment of the classification of types of data. Based upon this data classification, we determine an incident's materiality and establish the appropriate response, the incident management team, and the communications required to be distributed to third parties. Incident management policies are in place to establish the proper communication channels and responsible parties for different levels of materiality of an incident. We practice these policies and procedures in a tabletop or simulated fashion multiple times annually.

companyName: Mistras Group, Inc.

ticker: MG


text: With over 30 years of industry cybersecurity experience, the Company's Chief Information Security Officer ("CISO") is the member of the Company's management team with primary responsibility for the development, operation, and maintenance of the Company's information security program. The CISO supervises the Company's cybersecurity team, facilitates the incident response plan and acts as the liaison to the Company's executive management team, including relaying strategies, resource requests and incident updates. The Company's security event monitoring and detection capabilities are performed by our Cybersecurity team and third parties through the use of processes and tooling. Cybersecurity incidents are responded to by a multi-disciplinary Incident Response team and if appropriate, escalated to our Cybersecurity Disclosure Committee, Executive Management, and the Board. The level of escalation will vary depending on the severity and scope of the cyber incident. In the event of a severe cyber incident, the CISO will escalate to the relevant subcommittee to determine the course of action. All relevant roles are trained on their responsibilities regularly. The Board, along with the Risk and Audit Committees of the Board, oversees our information security program. In 2023, our Board and Risk and Audit Committees received periodic updates throughout the year on cybersecurity matters, and these updates are part of their standing agendas. These updates include reports regarding items such as cybersecurity strategies, program effectiveness, key risks and performance metrics related to the Company's information security program and the Company's mitigating controls.

companyName: AXIS CAPITAL HOLDINGS LTD

ticker: AXS


text: The Company's processes are integrated into its overall enterprise risk management program and compliments the Company's enterprise-wide risk assessment architecture, as implemented by the Company's management and as overseen by the Company's Board through its Audit Committee.

companyName: Quipt Home Medical Corp.

ticker: QIPT


text: Our Senior Director of Information Security reports to our Chief Information Officer and is responsible for leading our enterprise-wide information security team. The team focuses on developing and implementing strategies, processes and response plans to protect the confidentiality, integrity, and availability of our assets. Our Senior Director of Information Security has prior experience as a chief information security officer and over 25 years of experience in Technology and Security. Our security team also includes members who maintain industry security certificates. Our team is additionally supported by third parties to assist in the operations of our program, compliance audits and security penetration testing.

companyName: Envista Holdings Corp

ticker: NVST


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit and Risk Committee oversight of cybersecurity risks and the steps that management has taken to monitor and control exposure to such risks.

companyName: Walker & Dunlop, Inc.

ticker: WD


text: Our Chief Information Officer (CIO) leads our cybersecurity program and reports directly to our Chief Executive Officer. Our CIO is supported by our internal IT team that assists our CIO in the day-to-day management of the cybersecurity program, including the cybersecurity incident response plan, training initiatives and third-party assessments. Our CIO has over two decades of experience in various cybersecurity functions, including implementing stringent cybersecurity measures to protect sensitive information and meet established security standards, extensive work in IT governance and operations, network intrusion and critical systems protection, Enterprise Resource Planning (ERP) systems, and data analytics.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: Defending against information security and cybersecurity (collectively, "Security") threats demands a concentrated, collaborative approach and, as such, supplementary programs and processes have been instituted into governing Security and risk management strategies.

companyName: Business First Bancshares, Inc.

ticker: BFST


text: Given the complexity and evolving nature of the cybersecurity threat landscape, Hubbell has a dedicated team of internal and external cybersecurity professionals, led by Hubbell's Chief Information Security Officer ("CISO"), that regularly monitor alerts and meet to discuss threat levels, trends, and remediation. We engage a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our cybersecurity program. The engagement of third parties includes regular audits, threat assessments, and information system penetration tests. We also actively engage with key vendors, industry participants, legal counsel, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity policies and procedures. Hubbell further recognizes risks associated with the use of third-party service providers and has processes to identify material risks related to third parties. We conduct security assessments of third-party providers prior to their engagement and perform ongoing monitoring to ensure compliance with our cybersecurity standards. Our monitoring includes periodic assessments by the CISO and a team of cybersecurity professionals. Our cybersecurity risk management program is aligned to the National Institute of Standards and Technology Cyber Security Framework (NIST CSF).

companyName: HUBBELL INC

ticker: HUBB


text: Our Board has overall oversight responsibility for our risk management, including the cybersecurity risk management program. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Principal Accounting Officer, who receives reports from our cybersecurity consultants and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Any significant cybersecurity incidents are reported to the audit committee, which is 100% independent, and ultimately to our Board. There were no such cybersecurity incidents in fiscal 2023, 2022, or 2021. Management presents an assessment of our cybersecurity processes, procedures, and results of testing to the Audit Committee at least annually.

companyName: PHX MINERALS INC.


text: We, Kronos and CompX continually enhance our cyber defense strategy with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously bolstering our system resilience in an effort to minimize the business impact should an incident occur. Third parties also play a role in our cybersecurity. We, Kronos and CompX engage reputable third-party security firms for consultation on industry best practices and regulatory standards and to conduct routine evaluations of our cybersecurity, such as through penetration testing and security audits; these evaluations include testing both the design and operational effectiveness of security controls. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training through periodic updates. Employees in certain roles also receive additional role-based, specialized cybersecurity training.

companyName: VALHI INC /DE/

ticker: VHI


text: Our reputation for providing secure information storage to customers is critical to the success of our business, and protecting against material cybersecurity risks is an integral part of maintaining that reputation. A successful cybersecurity breach could lead to theft or misuse of our or our customers' proprietary or confidential information or our employees' personal information and result in third-party claims against us, regulatory penalties and reputational harm. As part of our information security program, we also actively monitor emerging cyberattack patterns to develop custom detection capabilities and mitigation techniques to protect against material risk of cybersecurity threats. Upon encountering a cybersecurity incident, our information security team responds using our detailed cybersecurity incident response plan ("CSIRP"), which is based on industry best practices, relevant legal requirements and our contractual commitments. Among other things, the CSIRP sets forth the specific criteria used to assess a cybersecurity incident, mitigate risks of adverse consequences associated with any such incident, protocols to escalate the management of the incident and the process to inform our executive management team and any impacted functions of our business. All cybersecurity incidents are assessed to determine whether disclosure is required pursuant to any contractual or regulatory requirements and any material cybersecurity incident is also reported to our board of directors (our "Board").

companyName: IRON MOUNTAIN INC

ticker: IRM


text: Cybersecurity is managed as part of our enterprise risk management program. We have integrated cybersecurity risk management into our enterprise-wide risk assessment through evaluations of IT infrastructure, compliance audits and aligning cybersecurity goals with overall business objectives. We work with cybersecurity experts to better understand potential cybersecurity threats.

companyName: UNIVERSAL ELECTRONICS INC

ticker: UEIC


text: Monitor Cybersecurity Incidents The CISO and the cybersecurity team are continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, which is an important component in designing programs to prevent, detect, mitigate, and remediate cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we have a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents and informing the board of significant cyber incidents in accordance with the Company's incident response plan.

companyName: Allegion plc

ticker: ALLE


text: To address this material weakness management has devoted, and plans to continue to devote, significant effort and resources to the remediation and improvement of our system for verification of which invoices to pay. We implemented additional controls related to vendor verification and will introduce mandatory cybersecurity training. We implemented a list of specific points to validate before payments are released, requiring evidence of validation by approvers.

companyName: ExcelFin Acquisition Corp.


text: Third-party cyber readiness assessments are conducted on a recurring basis and third-party tools are utilized to identify potential vulnerabilities. In addition to the third-party cybersecurity framework referenced above, regular cyber security reviews are conducted with internal audit.

companyName: Playa Hotels & Resorts N.V.


text: Our Information Security team manages Edwards' Information Security Program, which is focused on assessing, identifying, and managing cyber risk and information security threats. We evaluate cybersecurity risk on an ongoing basis, and it is a risk monitored through our overall enterprise risk management program, including by the executive leadership and the board of directors, described below under "Governance."

companyName: Edwards Lifesciences Corp

ticker: EW


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The technology committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The technology committee meets quarterly with members of management, including our CISO, Chief Information Officer ("CIO"), Chief Technology Officer or Senior Vice President of Engineering, as applicable, to discuss cybersecurity developments, significant cybersecurity threats and risks and the processes we have implemented to address them. The audit committee also receives presentations related to cybersecurity threats, risk and mitigation on a semi-annual basis unless more frequent discussions are necessary. The board of directors also receives a presentation from our CISO or CIO on our cybersecurity measures and risks at least annually.

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: To date, Northern Trust has not identified any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity threat or incident. For more information about these risks, see, "Breaches of our security measures, including, but not limited to, those resulting from cyber-attacks or other information security incidents, may result in losses," in Item 1A, "Risk Factors."

companyName: NORTHERN TRUST CORP

ticker: NTRS


text: The Company has processes in place to identify, assess and monitor material risks from cybersecurity threats, which are part of the Company's overall enterprise risk management process and have been embedded in the Company's operating procedures, internal controls and information systems.

companyName: Cohen & Co Inc.

ticker: COHN


text: Process The Company relies extensively on IT systems to operate and manage its business and process transactions. As a result, our business is at risk from, and may be impacted by, cybersecurity incidents. The Company's cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, which is used to benchmark and tailor the Company's strategies and program to our risk profile and specific operational needs and goals.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: Our management periodically evaluates information provided by its consultants on evolving cybersecurity risks and, based on its assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.

companyName: CytoDyn Inc.

ticker: CYDY


text: Service Center Physical Security for Data and Computing Equipment Policy, which provides directives for implementing appropriate physical security controls to protect the hardware, infrastructure, and systems that store and transmit our sensitive information and data from damage, unauthorized access, and loss of availability; to monitor, analyze, and properly disclose security alerts and information; and to administer other administrative and technical operational security procedures; and Security Incident Response Policy, which establishes the steps necessary to ensure a timely and adequate response to security incidents impacting our security systems or infrastructure.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: In addition, the Audit Committee receives regular reports on cybersecurity matters from the Chief Legal and Administrative Officer (CLAO) and the CISO. The Board of Directors is also updated by the CLAO and CISO on a periodic basis. Our CLAO, who reports directly to the President and CEO, has over 30 years of leadership experience across multiple industries in roles responsible for overseeing and managing risk. Our CISO, who reports directly to the CLAO, has extensive cybersecurity knowledge and skills gained from over 30 years of experience in consulting and technology roles, with more than 18 years of Information Security specialization. Our CISO is responsible for understanding, managing, and communicating cybersecurity risks internally to our management (including the Enterprise Risk Committee on which he serves), and works closely with our Legal department to oversee compliance with legal, regulatory, and contractual security requirements.

companyName: H&R BLOCK INC

ticker: HRB


text: Our Board is charged with providing oversight of our risk management process, including risks from cybersecurity threats. Periodically, the Board reviews risk assessments, including cybersecurity risks, prepared by management and/or third-party providers.

companyName: Fathom Digital Manufacturing Corp


text: In the event of a cybersecurity incident, we have an incident response plan in place. This plan includes detection, response, and communication with stakeholders. Incident response is supported by appropriate third-party experts to address, assess and respond to the event. The plan calls for the mobilization of a response team including both internal and external resources as well as communication protocols so that event information is shared on a proactive basis. We aim to prioritize transparency and accountability, and we are committed to providing timely and accurate information to our stakeholders in the event of a breach.

companyName: Ranger Energy Services, Inc.

ticker: RNGR


text: Communication of our cybersecurity values and expectations is extended to our third-party solutions through specific programs, which include monitoring and rating services and open-source intelligence risk assessments. In addition to conducting posture and intelligence reviews of our vendors, our cybersecurity teams conduct evaluations of critical vendors to assess security requirements, and we assess our service level agreements so that cyber controls and practices to the levels set out in our cybersecurity standards are embedded within.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: We engage third-party providers to assist us with our cybersecurity risk management and strategy. Examples of services provided by these third-party providers include threat monitoring, incident response support, testing, mitigation strategies, updates on emerging trends and developments and policy guidance. Prior to exchanging any sensitive data or integrating with key third-party providers, we assess their security fitness against our risk posture and request changes as we deem necessary. Security controls are imposed through comprehensive standard terms and conditions that include privacy and incident reporting requirements, and third parties are periodically re-evaluated for security risk.

companyName: EASTMAN KODAK CO

ticker: KODK


text: Cybersecurity Risk, Management, and Strategy Cybersecurity is a significant and integrated component of the Company's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Company's information systems. The Information Security Officer is primarily responsible for administering, updating and enforcing the cybersecurity components of the risk management strategy and reports to the Chief Risk Officer. The Information Security Officer periodically collaborates with third-party service providers and industry groups to discuss cybersecurity trends and best practices. The Information Security Officer is supported by the Chief Technology Officer, who reports directly to the Chief Financial Officer. The Chief Technology Officer oversees our Information Technology department, comprising our first line of defense.

companyName: HANMI FINANCIAL CORP

ticker: HAFC


text: The identification, detection, prevention and remediation of known or potential IT security vulnerabilities, including those arising from third-party hackers, hardware or software, is extremely costly and time consuming. Company does not have the manpower, expertise or financial resources to effectively identify, detect, prevent or remediate cybersecurity risks. No assurance or guarantee whatsoever can be given that Company will not be damaged by the exploitation of its cybersecurity vulnerabilities.

companyName: WEED, INC.

ticker: BUDZ


text: We have established and maintain incident response and recovery plans that address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: PROS Holdings, Inc.


text: In particular, the Chief Business Officer is responsible for hiring appropriate personnel and third-party vendors, communicating key priorities to relevant personnel, and, in concert with members of the Cybersecurity Risk Management Committee, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy. Our Chief Business Officer, Chief Accounting Officer, and Head of Legal, in consultation with our third-party information technology team, is responsible for maintaining cybersecurity-related budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Vera Therapeutics, Inc.

ticker: VERA


text: We undergo several annual internal compliance audits and external reviews to evaluate our controls, including cybersecurity controls. In an effort to minimize third-party risk, we have established a process to assess the security practices of third-party suppliers and related risks, including through review of relevant supplier certifications and security and responses to standardized information gathering (SIG) questionnaires, as applicable and appropriate.

companyName: Moderna, Inc.

ticker: MRNA


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers or who have access to our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.

companyName: AEHR TEST SYSTEMS

ticker: AEHR


text: Cyber Risk Management and Strategy The Company, under the oversight of the audit committee of the board of directors, has implemented and maintains an enterprise risk management process, which includes periodic assessments of various risk categories, including cyber risks, across the Company. Our process for assessing, identifying, and managing risks from cybersecurity threats is informed by industry standards and supported by cybersecurity technologies, including third-party security solutions, monitoring, and alerting tools, designed to monitor, identify, and address cybersecurity risks.

companyName: NEKTAR THERAPEUTICS

ticker: NKTR


text: Our chief financial officer is informed by our third-party monitoring service of any cybersecurity incidents, who will then escalate the incident to our chief executive officer, if necessary. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: MetaVia Inc.

ticker: MTVA


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance, however, that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. For more information, see the section titled “Risk Factors—Risks Related to Our Business Operations and Industry—Our information technology systems, or those of any of our service providers, may fail or suffer security incidents and other disruptions, which could result in a material disruption of our development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business.”

companyName: CG Oncology, Inc.

ticker: CGON


text: During 2024, we did not experience any cybersecurity threats that had a material impact or are reasonably likely to materially affect our business, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. Please see our "Risk Factors" in item 1A in this report for more information.

companyName: Clearwater Paper Corp

ticker: CLW


text: The Finance & Risk Committee receives periodic reports from CTO concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Finance & Risk Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: HA Sustainable Infrastructure Capital, Inc.

ticker: HASI


text: If we learn of a cybersecurity incident at a third-party service provider, our information technology department will maintain communication with that third-party service provider and communicate any cybersecurity incidents to the Vice President of Information Technology and CEO. All Harrow employees receive information security training (including data protection and fraud awareness) on an annual basis, and we use industry standard technology to monitor systems for anomalous behavior. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings. In the event an incident were to occur, a Security Incident Response Team would be convened that consists of members from many functions, including legal counsel, the Vice President of Information Technology and the CEO.

companyName: HARROW, INC.

ticker: HROW


text: We assess, identify and manage risks from cybersecurity threats through CNH's Information Technology Security and Compliance organization ("Cybersecurity Program"), which is part of CNH's larger enterprise risk management framework. The Cybersecurity Program is currently overseen by the Audit Committee of the Board of Directors for CNH (the "CNH Audit Committee") and is managed by CNH's Chief Information Officer (the "CNH CIO") and a dedicated CNH Chief Information Security Officer (the "CNH CISO"). The CNH CISO's organization has oversight of cybersecurity strategy, policy, standards, architecture and processes for the security of our enterprise network and, information assets. The CNH CISO's organization monitors and manages, and works to identify and assess, cybersecurity risk through various technologies, resources, processes and policies that are updated to align with the changing threat landscape, our evolving business needs and global regulatory requirements. Our strategy includes risk assessments, risk and threat analysis, utilization of security tools, cybersecurity-related tabletop and phishing exercises designed to simulate cybersecurity incidents, and security awareness and technical security trainings.

companyName: CNH Industrial Capital LLC


text: As part of our risk management process, we conduct application security and vulnerability assessments, undergo third-party penetration testing of both our digital and physical assets, maintain ongoing risk assessments, and monitor various third-party risk feeds. Our risk management processes also assess third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners. In evaluating our response to our application security assessments, penetration tests, and risk feeds, our team collaborates with technical and business stakeholders to further analyze the risk to the company, and form detection, mitigation and remediation strategies to enhance our current security program. Our security program is aligned to the National Institute of Standards and Technology Cybersecurity Framework Special Publication (NIST) 800-53 standard, and we have obtained a SOC 2 Type 2 Certification. Although we refer to such frameworks in developing our cybersecurity risk management approaches, our use of them as guides is not intended to suggest that we meet any particular technical standards, specifications, or requirements set forth therein.

companyName: IonQ, Inc.

ticker: IONQ


text: We continue to work with outside counsel and third - party service providers to further develop our expertise, processes and procedures with respect to cybersecurity protection and our response plan.

companyName: TECHPRECISION CORP

ticker: TPCS


text: If management determines that a cybersecurity threat or incident could be material to the Company, our management will notify the Audit and Compliance Committee, who will then escalate the risk to our full Board of Directors, depending on management's assessment of the risk.

companyName: Ventas, Inc.

ticker: VTR


text: The Company understands the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of the Company's overall risk assessment process. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: GlobalTech Corp

ticker: GLTK


text: As a global technology company, and the provider of electronic trading platforms and solutions for fixed-income and other securities, we view cybersecurity as fundamental to our business. Accordingly, we aim to appropriately secure all of our business operations, including information that we generate in the performance of our services, and data provided to us by third parties, including clients, vendors, business partners and employees.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: As part of the information security program, we conduct periodic exercises with independent outside advisors to assess the effectiveness of our program and our internal response preparedness. We regularly engage with the broader cybersecurity community and monitor cyber threat information.

companyName: PRUCO LIFE INSURANCE CO


text: Although risks from cybersecurity threats have not materially affected, and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our and our third-party vendors' information systems. For more information about the cybersecurity risks we face, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor titled "Cybersecurity incidents, data breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."

companyName: Absci Corp

ticker: ABSI


text: for incorporating cybersecurity risks into the overall risk management process process for identifying, assessing, and managing risks related to cybersecurity generally involves CyberTeam regularly meeting with our executive leadership team, and when appropriate, our board and/or audit committee to discuss cybersecurity related risks identified and the potential likelihood and severity of each risk.

companyName: Lucid Diagnostics Inc.

ticker: LUCD


text: Our Board of Directors administers its cybersecurity risk oversight function directly through our Audit and Finance Committee ("AFC"). Our AFC has primary responsibility for overseeing our risk management practices, programs, and policies related to data privacy, data protection, and cybersecurity. The AFC reviews and evaluates the processes utilized by management to identify and assess the material internal and external risks that may affect our business. Our AFC regularly discusses the our major risk exposures with management, legal counsel, and the internal audit department. This includes potential financial impact on the Company and the steps taken to monitor and control those risks. Annual reviews with management include a summary of legal and regulatory compliance matters, risk management activities, and including a review of our cybersecurity program. Additionally, our AFC oversees the process by which our Board of Directors is informed regarding the risks facing the Company and coordinates with our legal counsel to ensure our Board of Directors receives regular risk assessment updates from management.

companyName: EXACT SCIENCES CORP

ticker: EXAS


text: The ISP also incorporates a vendor due diligence process that is designed to assess vendor control environments and evaluate risks associated with vendor access to the Company's confidential data and systems. The process includes assessing and managing the cyber risks associated with engaging third-party vendors and reviewing their information security practices.

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: To date, risks from cybersecurity threats or incidents have not materially affected the Company. However, the sophistication of and risks from cybersecurity threats and incidents continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cybersecurity threats and incidents and protect its systems and information may not successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect the Company's business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.

companyName: FirstCash Holdings, Inc.

ticker: FCFS


text: Our company recognizes the critical importance of cybersecurity in our digital operations and has established a robust risk management program to address both internal and external cybersecurity threats. This program, guided by industry frameworks like NIST CSF and overseen by experienced leadership teams, integrates advanced security tools and practices into our broader enterprise risk management system, actively involving our Executive team and Board of Directors in its oversight. Despite our comprehensive efforts and critical resource allocation, we acknowledge the challenges posed by the evolving nature of cyber threats and the limitations in fully mitigating these risks. We have not observed any significant impacts from known cybersecurity threats or previous incidents on our operational, strategic, or financial aspects. Nevertheless, given the unpredictable nature of cyber threats, we cannot assure complete immunity against potential future impacts.

companyName: BED BATH & BEYOND, INC.

ticker: BBBY


text: We depend heavily on various information systems and electronic resources to conduct our business operations. Additionally, a majority of our clients, service providers, and other business partners on whom we rely, including providers of our online banking, mobile banking, and accounting systems, utilize their own electronic information systems. Any of these systems are susceptible to compromise, whether by employees, clients, or other authorized individuals, by malicious actors employing sophisticated and continuously evolving software, tools, and strategies. Given our status as a financial services provider and our relative size, we and our business partners are considered high-value targets for such malicious actors. For further details, please refer to the "Risks Related to Information Security and Business Interruption" section of As a result, we have devoted significant resources to assessing, identifying, and managing cybersecurity risks and threats, including: Maintaining policies and procedures regarding security operations and governance through the implementation of an Information Security Program; Establishing a committee responsible for security administration, including regular assessments of our systems, existing controls, vulnerabilities, and potential improvements; Implementing multi-layered controls to avoid reliance on single controls; Utilizing both preventative and detective tools to monitor and block suspicious activity and to alert of potential threats; Keeping abreast of new technology and evaluating tools to help respond to threats to cybersecurity in real time; Managing and maintaining cybersecurity controls utilizing available people, processes and technology; Utilizing a third-party risk management program for purposes of identifying, assessing and managing risks involved with external service providers; Conducting thorough due diligence concerning our third-party service providers, including evaluating their cybersecurity practices;

companyName: SOUTHERN FIRST BANCSHARES INC

ticker: SFST


text: To proactively identify, mitigate, and prepare for potential cybersecurity incidents, we maintain both a business continuity plan and cyber incident response plan with formalized workflows and playbooks. We periodically conduct simulation exercises involving employees at various levels of the organization. We also periodically engage external partners to conduct annual audits of our systems, and test our IT infrastructure. Through these channels and others, we work to proactively identify potential vulnerabilities in our information security system. We recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. To minimize the risk and vulnerabilities to our own systems stemming from such use, our Information Security team identifies and addresses known cybersecurity threats and incidents at third-party service providers on a continuous basis. In addition, we strive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process.

companyName: Edwards Lifesciences Corp

ticker: EW


text: We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Our cybersecurity risk management program is integrated into our overall enterprise risk management ("ERM") process which provides an ongoing procedure, effected at all levels of the Company and across business units and corporate functions, to identify and assess risk, monitor risk, and take appropriate mitigating action. Central to our risk management process is the Risk Committee, a management committee that oversees the identification and assessment of the key risks affecting our operations and reviews the controls established with respect to these risks. The Risk Committee is comprised of key members of management, including the President, Chief Financial Officer, Chief Legal Officer, Chief Information Security Officer, Chief Technology Officer, Chief Compliance Officer, and other senior executives of the Company. Our Risk Committee collaborates with subject matter experts, as needed, to gather insights for identifying and assessing material cybersecurity risks, their severity, and potential mitigations.

companyName: BROADRIDGE FINANCIAL SOLUTIONS, INC.

ticker: BR


text: These processes are also designed to address cybersecurity threats associated with the use of third-party providers. When selecting third-party service providers, associated cybersecurity threats are assessed, and, in addition, ongoing cybersecurity risk assessments of third-party service providers are conducted. These third-party service providers are also required to provide notifications of material breaches that may impact Vista's data. Vista incorporates the cybersecurity risk coordination and assessment of third-party service providers into the overall cybersecurity program and enterprise-wide risk management.

companyName: VISTA CREDIT STRATEGIC LENDING CORP.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."

companyName: Autolus Therapeutics plc

ticker: AUTL


text: With the assistance of our IT vendor, we established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an information technology ("IT") consultant who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process. Our Board of Directors provides oversight to our cybersecurity efforts to ensure effective governance in managing risks associated with cybersecurity threats. Our CFO provides periodic updates to the Board of Directors regarding our cybersecurity program, including information about cyber risk management governance and status updates on various projects intended to enhance the overall cybersecurity posture of the Company.

companyName: Harvard Apparatus Regenerative Technology, Inc.

ticker: HRGN


text: The Fund depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. Through its vendor management program, and on behalf of the Fund, Fidelity oversees and identifies risks from cybersecurity threats associated with the use of third-party service providers. This vendor oversight program includes periodic reviews of the cybersecurity controls of third-party service providers, The frequency of such reviews is generally based on the nature of the Fund's information processed by the vendor and the vendor's criticality to business operations.

companyName: Fidelity Private Credit Co LLC


text: As a leader in building and operating electronic marketplaces, we face a broad set of cybersecurity risks stemming from managing complex technology systems, handling sensitive data, and the digital nature of our business. Managing cybersecurity risk is critically important to our business. We have comprehensive cybersecurity risk management and governance systems in place across our global operations designed to support successful operation of our systems.

companyName: Tradeweb Markets Inc.

ticker: TW


text: The head of Oaktree's cybersecurity team has substantial information technology and cybersecurity experience, with a career spanning over 25 years in managing global IT operations in a wide range of areas, including cybersecurity, IT governance, controls, compliance, data center operations, network engineering and cloud computing.

companyName: Oaktree Specialty Lending Corp

ticker: OCSL


text: Key aspects of our cybersecurity risk management program include the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and processes; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers and vendors.

companyName: DZS INC.


text: We have in place an Incident Response Procedure policy to define our response to unauthorized network intrusions or other significant information security incidents, collectively cybersecurity incidents. The policy defines the standard operational process to determine if an event observed on a system could have caused a breach of the system or a compromise of sensitive data. This policy serves to establish a formal process to report incidents and track response activities. It also defines escalation processes within the Information Security team and further escalation to our Cybersecurity Incident Response Team. It is the responsibility of the Cybersecurity Incident Response team to determine if an incident is material. The Cybersecurity Incident Response Team consists of members from functional groups across our organization including executive management, IT, the CISO, legal, finance and operations. We may include other individuals, including third parties, as appropriate depending on the nature of the incident and system(s) involved. This cross-functional group allows us to address the operational impacts of cybersecurity incidents as and when they occur and to guide decisions related to materiality and, if applicable, disclosure. The Cybersecurity Incident Response Team is responsible for extrapolating cybersecurity incident event information into quantitative and qualitative impacts as they relate to our financial condition and operations. In addition, the Company's Incident Response Procedure policy includes reporting to the board of directors for certain cybersecurity incidents.

companyName: POWER INTEGRATIONS INC

ticker: POWI


text: As part of its overall enterprise risk management program, Angel Oak Capital has developed an information security framework (the "Cybersecurity Program"). The purpose of the Cybersecurity Program is to mitigate the risks associated with unauthorized attempts to access Angel Oak Capital's (including our) network for unintended purposes. The Cybersecurity Program is used to assess and understand risks involving information systems and to provide controls and procedures for mitigating those risks and promptly responding to cybersecurity threats and incidents.

companyName: Angel Oak Mortgage REIT, Inc.

ticker: AOMR


text: Our board of directors, as a whole and through the Audit Committee, is responsible for the oversight of risk management, including oversight of risks from cybersecurity threats, and discusses with management our major risk exposures, including from cybersecurity threats, their potential impact on us, and the steps we take to manage them.

companyName: IO Biotech, Inc.

ticker: IOBT


text: While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful threats or incidents.

companyName: FORUM ENERGY TECHNOLOGIES, INC.

ticker: FET


text: Oversight of Third-party Service Providers: We acknowledge the potential risks associated with our use of third-party service providers. Therefore, we have established processes to oversee and identify material cybersecurity risks that may be associated with third-party service providers with whom we engage. This includes conducting thorough, risk-based due diligence before onboarding, performing security assessments, and confirming adherence to our cybersecurity requirements. We also maintain active communication channels with these providers to stay informed about any potential security incidents or concerns.

companyName: TRANSCONTINENTAL GAS PIPE LINE COMPANY, LLC


text: The Company, at least annually, updates its policies or procedures that could help mitigate cybersecurity risks. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. The Company has incorporated cybersecurity coverage in its insurance policies; however, there is no assurance that the insurance the Company maintains will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related losses.

companyName: CEDAR REALTY TRUST, INC.

ticker: CDR-PC


text: Our executive officers report material cybersecurity incidents to the Board of Directors. Management provides cyber related legal, regulatory, compliance, risk, and relevant industry and internal threat updates to the Board of Directors as needed. The updates provide information regarding the state of the Company's information security program, the nature, timing and extent of cybersecurity incidents, if any, and the Company's resolution to such matters.

companyName: ENDI Corp.

ticker: ENDI


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K, including the risk factor entitled "Risks Related to Our Business and Strategy —Security breaches and incidents, loss of data, and other disruptions could compromise sensitive information related to our business, or information of our customers, users of our products, healthcare stakeholders or others, or prevent us or our customers, users of our products, healthcare providers, healthcare payors or others from accessing critical information, all of which could result in a material adverse effect, including without limitation, a material operational or service interruption, harm to our reputation, significant fines, penalties and liability, breach or triggering of Data Protection Laws, Privacy Policies and Data Protection Obligations, loss of customers or sales, or customers curtailing or ceasing their use of our services."

companyName: Cue Health Inc.


text: As a part of the Company's overall risk management and compliance programs, we have developed an enterprise cybersecurity program designed to detect, identify, classify and mitigate cybersecurity and other data security threats. Our enterprise cybersecurity program classifies potential threats by risk levels and we typically prioritize our threat mitigation efforts based on those risk classifications, while focusing on maintaining the resiliency of our systems. In recent years, we have increased our investments in our ability to detect, identify, classify and mitigate cybersecurity and other data privacy risks within our environment. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, our Board of Directors, other stakeholders and law enforcement when responding to such issues. Additionally, our cybersecurity program is regularly assessed by independent third parties, and we incorporate regular information security training as part of our employee education and development program. We maintain cybersecurity insurance as part of our comprehensive insurance portfolio.

companyName: Hanesbrands Inc.


text: Hines' CISO and CTO are principally responsible for overseeing the cybersecurity risk management program, in partnership with other Hines leaders. The CISO has more than 30 years of experience in the IT industry, with over 20 years spent working with cybersecurity design and implementation, as well as infrastructure, audit, design, operation, and as the head of Hines' IT security and compliance practice. The CTO previously served as both Director and Vice President of Information Technology at Hines and has led several Hines technology implementations and strategic developments of proprietary applications and infrastructure.

companyName: HINES GLOBAL INCOME TRUST, INC.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, utilizing, from time to time, tabletop exercises, business unit assessments, threat modeling, impact analyses, internal audits, external audits, third party vulnerability scans, third party penetration tests, and engagement of third parties to conduct analysis of our information security programs, including an overall assessment utilizing the NIST standards. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to team members or customers, and violations of data privacy or security laws.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: Our cybersecurity policies require that we implement and maintain monitoring and detection programs, network security precautions, encryption of critical data, and management of third-party risk. We maintain various protections designed to safeguard against cyberattacks, including but not limited to attack surface management, anti-phishing secure email gateways, log monitoring and analysis, cloud security posture management, endpoint detection and response, and network intrusion detection and prevention systems. We also have processes in place to prevent unauthorized access to data processing systems and facilities, including two-factor authentication, tiered approval processes and password complexity, and our employees and applicable contractors undergo mandatory privacy and security trainings annually. We have established and periodically test our disaster recovery plan and we protect against business interruption by backing up our major systems. In addition, we periodically scan our environment for any vulnerabilities, perform penetration testing and engage third parties to assess the effectiveness of our data security practices and compliance with applicable practices and standards. In addition, we maintain a third-party risk register to identify, prioritize and track risks, including those associated with our use of third-party service providers. We also maintain cybersecurity insurance coverage though it may not be sufficient to cover all costs of a cybersecurity incident.

companyName: Guardant Health, Inc.

ticker: GH