text: The Company seeks to ensure every employee understands their role in keeping ONE Gas safe from cyber incidents. As part of this commitment, we require our employees to complete recurring cybersecurity awareness training that provides immediate feedback and, if necessary, additional training or remedial action to employees.

companyName: ONE Gas, Inc.

ticker: OGS


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our IT Systems Administrator. Our IT Systems Administrator has 15 years in total network and system administration experiences, 8 of which are experience addressing cybersecurity risks. Our IT Systems Administrator is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. Our Vice President of Corporate Development & Administration oversees the IT Systems Administrator and briefs our board of directors on cybersecurity matters, including the nature and design of our cybersecurity program, and threats, events, and program enhancements.

companyName: Nauticus Robotics, Inc.

ticker: KITT

secItem: Item 1C


text: Objectives and Key Principles and Priorities The objective of the Security and Compliance Team is to build practices within the company to define, implement, enforce, and measure our security, compliance and disaster recovery readiness. In doing so, it utilizes some of the following key guiding principles and priorities: • Alignment. Working within the organization to clearly define the need for secure computing practices, gaining buy-in on this need and the development of a mindset across the organization around secure computing. • Measurement and Visibility. Developing measurement and reporting methods which inform our stakeholders both in the business as well as external audit and other outside entities as to compliance with various security frameworks and regulatory obligations. • Protection. Using a commonly accepted industry framework to build and ensure the enforcement of policies and procedures which secure the data and systems of all our stakeholders. • Response. Ensuring that that if a security incident occurs there is a clear and well understood response plan which is followed by all response participants. • Resources and Tools. Identifying the resources needed to run the cybersecurity program commensurate with the size and complexity of our company, including identifying and implementing appropriate tools and systems to help strengthen our security posture.

companyName: Zumiez Inc

ticker: ZUMZ


text: As part of the QNB's overall risk management processes, it has established both the Information Technology Committee and the Security Committee. The Technology Committee comprises the executive management team, selected department heads, and the Information Security Officer ("ISO"). The Technology Committee reports to the Board of Directors. The second committee is the Information Security Committee, composed of QNB's Chief Operations & Technology Officer ("COTO"), the Information Technology Director, and the ISO. The Information Security Committee reports to QNB's Audit Committee. QNB's COTO presents a detailed report on information systems and cybersecurity matters to the Board of Directors at least once annually. The Board of Directors also receives and reviews copies of minutes of all meetings of the Audit Committee and the Information Technology Committee.

companyName: QNB CORP.

ticker: QNBC


text: Our technology and cybersecurity programs are crucial to maintaining secure operations, which enable us to deliver on our promise to maintain stakeholder trust. Our Chief Financial Officer ("CFO") is responsible for establishing, implementing and executing our cybersecurity program and strategy. Our CFO has over nine years of information technology, information technology audit, and cybersecurity experience, and is involved in following the latest developments in cybersecurity, including potential threats and innovative risk management techniques.

companyName: SOLIGENIX, INC.

ticker: SNGX


text: As part of our IRP, we conduct regular testing to ensure that the IRP is functional and effective. Tests may include tabletop exercises, verbal walkthroughs with relevant stakeholders, or responses to actual security incidents.

companyName: ContextLogic Inc.


text: Corporate Controller reports to our CEO/CFO on matters of cybersecurity, and together they carry responsibility for our overall cybersecurity risk management program. Our CEO/CFO provides prompt reports to the Board regarding cybersecurity risks and incidents as they are revealed, as well as periodic reports, as appropriate, regarding the Company's cybersecurity program.

companyName: Beeline Holdings, Inc.

ticker: BLNE


text: Our Vice President, Information Technology and Facilities, or the VP of IT, leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Our VP of IT has worked in the information technology field for over 20 years at both biotechnology companies and management consulting firms, and holds a Bachelor of Science in Management and a Masters of Business Administration. We also maintain a team of experienced senior level engineers who design, implement and operate our information technology ecosystem, helping to implement cybersecurity best practices throughout our information technology infrastructure and governance processes. We periodically assess our processes against cybersecurity frameworks, such as the National Institute of Standards and Technology, or NIST, Cybersecurity Framework, Center for Internet Security, or CIS, Controls, and International Organization for Standardization, or ISO, 27001.

companyName: AGIOS PHARMACEUTICALS, INC.

ticker: AGIO


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, including cybersecurity risks. The full Board receives a network health report at each board meeting from our COO/ IT Manager, which addresses our overall network risk including any relevant cybersecurity threats and incidents.

companyName: Bank7 Corp.

ticker: BSVN


text: Chief Executive Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from third-party service providers and outside counsel, as needed. Chief Executive Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy"

companyName: CalEthos, Inc.

ticker: GEDC


text: We believe cybersecurity is the responsibility of every employee, and regularly educate and share best practices with our employees to raise awareness of cybersecurity threats through a security awareness training program, including regular exercises, periodic cyber-event simulations and annual attestation to our Technology Acceptable Use Policy.

companyName: THERMO FISHER SCIENTIFIC INC.

ticker: TMO


text: In 2023, we did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition; however, cybersecurity threats are pervasive. Despite the capabilities, processes and security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Moreover, cybersecurity threats are continuously evolving, which may cause cybersecurity threats to be more difficult to detect in the future. See "Risk Factors - Risks Related to Cybersecurity and Information Technology" in Part I, Item 1A of this Form 10-K, for additional information about these and other risks related to cybersecurity and information technology.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: We recognize the critical importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data.

companyName: Palladyne AI Corp.

ticker: PDYN


text: Our Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. Board members receive presentations on cybersecurity topics from our Vice-President of Information Technology ("VPIT") and our Director - Information Security ("DIS") or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: ENERPAC TOOL GROUP CORP

ticker: EPAC


text: The Executive Officers and Vice President, Corporate Services are involved in all significant and appropriate cybersecurity decisions on the implementation and design of our IT architecture. Vice President, Corporate Services, along with support from the Director of IT, is responsible for the assessment and management of risks from cybersecurity threats and oversees the implementation of IT processes, which includes cybersecurity, into the core business of the Company. The Director of IT has extensive cybersecurity knowledge and skills gained from over 20 years of relevant work experience. The Director of IT discusses all potential changes to the Company's controls or detection systems with the Vice President, Corporate Services prior to implementation. The Vice President, Corporate Services is updated by the Director of IT on a regular basis regarding trends in technology and cybersecurity threats or any potential changes to the Company's cybersecurity program. The Director of IT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through a number of experienced direction systems and third party cybersecurity providers. The Vice President, Corporate Services also attends certain meetings of the Audit Committee to report information on material risks from cybersecurity threats. None of our critical core business activities that impact production, transportation or sales of oil and gas are remotely controlled.

companyName: GRAN TIERRA ENERGY INC.

ticker: GTE


text: Moreover, the communication between the front-end and backend components of our platform is secured with security tokens, which prevent unauthorized access and ensure that only authenticated requests are processed. Personal information required for integrations with external systems is encrypted using hash algorithms, further securing data at rest and in transit. These security practices highlight our commitment to maintaining the confidentiality, integrity, and availability of user data. Our adherence to best security practices and utilization of AWS's advanced security features showcase our platform as a secure and reliable solution for customers seeking privacy and protection while purchasing sensitive health-related products. are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.

companyName: MANGOCEUTICALS, INC.

ticker: MGRX


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). Signet conducts periodic assessments against the NIST CSF and reviews key cybersecurity risks, utilizing a third party to perform this assessment of the Company's cyber risk management program. The risk assessments, together with risk-based analysis and judgment, are used to determine security controls to address identified risks. Signet has strategically integrated cybersecurity risk management into the Company's policies and broader enterprise risk management framework to promote a company-wide culture of cybersecurity. Signet considers the following factors, among others, during the process of determining how to address risks and which controls to implement: likelihood and severity of the risk; the impact on the Company, the Company's customers, employees, and shareholders; and if a risk materializes, the feasibility and cost of controls and the impact of controls on operations.

companyName: SIGNET JEWELERS LTD

ticker: SIG


text: As part of Voya Financial's overall information security program, it may engage and retain external assessors and consultants to help improve our security, stay aligned with industry best practices, evaluate external threats and, on an as-needed basis, perform forensic reviews of cybersecurity-related incidents or independent security assessments.

companyName: VOYA RETIREMENT INSURANCE & ANNUITY Co


text: We also maintain an ongoing end-user cybersecurity awareness program that is designed to raise awareness of cybersecurity threats to reduce our vulnerability as well as to encourage consideration of cybersecurity risks across functions, including quarterly training and simulated phishing campaigns.

companyName: Prime Medicine, Inc.

ticker: PRME


text: Company acknowledges the increasing importance of cybersecurity in today's digital and interconnected world. Cybersecurity threats pose significant risks to the integrity of our systems and data, potentially impacting our business operations, financial condition, and reputation.

companyName: La Rosa Holdings Corp.

ticker: LRHC


text: The Company's information security function and management team is led by our Vice President of Information Technology and Cybersecurity, who has approximately 39 years of experience in the information technology area and holds the CISM certification, and our Senior Director of Information Technology Infrastructure and Cybersecurity, who has approximately 26 years of experience in the information technology area and holds CISSP, CCSP, CISM, and OSCP certifications.

companyName: SANFILIPPO JOHN B & SON INC

ticker: JBSS


text: Our Board of Directors (the "Board") oversees all cybersecurity risk management activities. At least annually, the CISO, CIO and other members of the cybersecurity committee report to the Board on the state of our cybersecurity risk management program and current and emerging cybersecurity risks. The Board's Audit Committee has been delegated strategic oversight of the cybersecurity committee and our cybersecurity risk management program, and is responsible for providing feedback, as needed. Any cybersecurity incident deemed to have a moderate or higher business risk also is reported to the Board.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: Certain representatives of Angel Oak Capital, including our Manager, periodically report to the Audit Committee as well as to the full Board of Directors, as appropriate, on cybersecurity matters, primarily through presentations by the Head of IT. Such reporting includes updates on the Cybersecurity Program as it impacts us, the reports and services provided by the IT Service Provider, the external threat environment, risk management strategies and any cybersecurity threats or incidents. Presentations to the Audit Committee or the full Board of Directors may also be provided from time to time by the IT Service Provider or another third party firm providing cybersecurity-related services for us or Angel Oak Capital, including our Manager, as deemed necessary or appropriate. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity.

companyName: Angel Oak Mortgage REIT, Inc.

ticker: AOMR


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Risks Related to Our Business and Operations – If our information technology systems or those of third parties with whom we work of our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."

companyName: MALIBU BOATS, INC.

ticker: MBUU


text: We utilize a commercially available third-party hosted cloud network environment with commercially available systems, software, tools and monitoring to provide security to protect our information and data and alert us to potential information security breaches. The third party engaged by us to oversee and host our network was engaged, in part, because of its experience with information security and data protection and products designed to manage against information and data security breaches. We conduct mandatory annual cybersecurity training for employees and have information security and data privacy policies and procedures in place applicable to our directors, officers, and employees.

companyName: GETTY REALTY CORP /MD/

ticker: GTY


text: The Board of Directors' overall risk oversight function includes receiving reports on the Company's cybersecurity risks and our risk management processes, and assessing whether our risk management strategies are reasonably designed to address such risks. The Board has delegated this oversight responsibility to our Audit Committee, which reports periodically to the Board as appropriate.

companyName: CIRRUS LOGIC, INC.

ticker: CRUS


text: Organization and Management The Global Chief Information Security Officer ("CISO") reports to the Global Chief Information Officer, and is a member of key cybersecurity governance forums. The CISO leads the Global Cybersecurity and Technology Controls organization, which is responsible for identifying technology and cybersecurity risks and for implementing and maintaining controls to manage cybersecurity threats. The CISO and the members of senior management within Global Technology and the Cybersecurity and Technology Controls organizations all have relevant expertise and experience in cybersecurity and information technology risk management, including relevant experience at J.P. Morgan, at other financial services companies or in other highly-regulated industries.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: The Chief Information Officer oversees our broader IT strategy, including cybersecurity, and presents quarterly to the Enterprise Risk Management Committee, bi-annually to the Audit Committee, and annually to the Board. The Chief Information Officer's expertise in information technology, cybersecurity, and strategic planning, forged over 24 years, 20 of which has been spent in leadership at global publicly traded companies, is integral to our approach to cybersecurity risk management. This expertise is crucial in aligning our cybersecurity initiatives with business objectives, ensuring that our strategies effectively support the Company's overall goals.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: Our technology infrastructure and information systems also support and form the foundation for our accounting and finance systems and form an integral part of our disclosure and accounting control environment. Most of our systems and processes are provided by third-party vendors and may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information.

companyName: CQENS Technologies Inc.


text: Our CDTO is a member of our executive management team who is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. Our CDTO has over twenty years of extensive experience in information technology and security, and works in coordination with other members of the management team, including, among others, the Chief Financial Officer, the Chief Compliance Officer and the Chief Legal Officer and their designees. We believe our business leaders have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.

companyName: BrightSpring Health Services, Inc.

ticker: BTSG


text: The CISO reports to the CIO and partners with the Company's Risk, Audit, Legal and Compliance Departments to promote alignment of cybersecurity risk management strategy with the broader risk management strategy for the organization. The integration of information security into the overall enterprise risk management framework enables collaboration on the identification, assessment, mitigation and monitoring of cybersecurity risks that have the potential to materially impact the operation of the Company.

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: The Vice President and our Chief Operating Officer and General Counsel participate in periodic discussions with other members of our management, including executive leadership, regarding implementation of our cybersecurity program, program enhancements, and relevant cybersecurity risks or threats.

companyName: Korro Bio, Inc.

ticker: KRRO


text: Cybersecurity governance is a priority for both our Board of Directors and management. The Board has delegated primary oversight of cybersecurity risks to the Audit Committee. The Audit Committee monitors the cybersecurity risk management and cyber control functions, including external security audits. The Audit committee receives periodic updates from experienced senior management of the Company's cyber risk management team knowledgeable about assessing and managing cyber risks, including, as appropriate, updates on the prevention, detection, mitigation, and remediation of cyber incidents.

companyName: BrightView Holdings, Inc.

ticker: BV


text: Because of the size and scope of Prudential's business, Prudential, the Manager, their affiliates and the Company are subject to numerous and evolving cybersecurity risks, any of which, if it materializes, could affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors—Risks Related to Market Events and Regulatory Developments—We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information" for a discussion of such risks.

companyName: PGIM Private Credit Fund

ticker: PGIM


text: At the management level, our CISO leads our enterprise-wide cybersecurity program, and is responsible for assessing and managing our material risks from cybersecurity threats. In performing his role, our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through the management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. Our CISO reports to our Interim Chief Information Officer who, in turn, reports to our Chief Operating Officer and member of our executive leadership team.

companyName: FLEX LTD.

ticker: FLEX


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a structured third-party risk management program that includes due diligence, contractual security requirements, and continuous monitoring for service providers, suppliers, and vendors to mitigate risks associated with external partnerships..

companyName: Shake Shack Inc.

ticker: SHAK


text: We use third-party services to assist with penetration testing, security incident monitoring, incident response preparation, end point protection, and security awareness online training.

companyName: Cronos Group Inc.

ticker: CRON


text: Board and Management's Role in Data Privacy and Cybersecurity Oversight Our board of directors recognizes the oversight of risk management as one of its primary responsibilities and central to maintaining an effective, risk-aware and accountable organization. While the board of directors maintains ultimate responsibility for the oversight of our data privacy and cybersecurity program and risks, it has delegated certain oversight responsibilities to our audit and risk committee. Our board of directors and audit and risk committee's principal role is one of oversight, recognizing that management is responsible for the design, implementation, and maintenance of an effective program for protecting against and mitigating data privacy and cybersecurity risks. The audit and risk committee assists the board of directors in enhancing its understanding of data privacy and cybersecurity issues by overseeing our data privacy and information security programs, strategy, policies, standards, architecture, processes, and significant risks, as well as overseeing responses to security and data incidents, as appropriate.

companyName: Block, Inc.

ticker: XYZ


text: We, like many other companies in the gaming and entertainment space, including some of our market access partners and suppliers, experience routine cybersecurity threats such as DDOS, phishing or social engineering attacks. While our business strategy, results of operations and financial condition have not been materially affected by risks from any such cybersecurity threats, including as a result of previously identified cybersecurity incidents, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.

companyName: Rush Street Interactive, Inc.

ticker: RSI


text: Global Recovery. We have developed global cyber and disaster recovery processes for our information technology systems and critical information assets to preserve business continuity in the event of a cybersecurity incident.

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats to and security incidents relating to our information systems. For more information, please see "Risk Factors – Our business could be adversely affected if our data privacy and security practices are not adequate, or perceived as being inadequate, to prevent data breaches, or by the application of data privacy and security laws generally" and "Risk Factors - A failure of Brag House's information technology (IT) and data security infrastructure could adversely impact our business, operations, and reputation."

companyName: Brag House Holdings, Inc.

ticker: TBH


text: Under a final rule adopted by federal banking agencies in 2021, banking organizations are required to notify their primary banking regulator within 36 hours of determining that a "computer-security incident" has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization's ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss, or its operations that would impact the stability of the United States. The federal banking agencies have also adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of the Board of Directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial services. Moreover, recent cyberattacks against banks and other financial institutions that resulted in unauthorized access to confidential customer information have prompted the federal banking regulators to issue more extensive guidance on cybersecurity risk management. Among other things, financial institutions are expected to design multiple layers of security controls to establish lines of defense and ensure that their risk management processes address the risks posed by compromised customer credentials, including security measures to authenticate customers accessing internet-based services.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: We engage certain external parties, including cybersecurity and privacy firms, to enhance our cybersecurity oversight and risk reduction abilities. We also perform an annual cybersecurity assessment designed to help align our cybersecurity program with industry best practices. In addition, we regularly consult with industry groups, peer organizations, and external executives to assess the cybersecurity threat landscape throughout the year.

companyName: Sage Therapeutics, Inc.


text: of the date of this report, the Company has not experienced any material cybersecurity incidents, nor has it identified any material cybersecurity threats that have affected or are reasonably likely to materially affect its business strategy, results of operations, or financial condition.

companyName: Cluster Group Holdings Ltd Co

ticker: CLUS


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We maintain a strategic plan to protect our information and to manage and mitigate emerging cybersecurity threats. Our cybersecurity team, led by our Chief Information Security Officer ("CISO"), who reports to our Chief Digital & Information Officer ("CDIO"), oversees our cybersecurity efforts on a day-to-day basis. Our cybersecurity team, in partnership with third parties, designs, implements and operates our data security and cybersecurity programs, risk assessments, monitoring procedures, and training programs for our associates.

companyName: Ferguson Enterprises Inc. /DE/

ticker: FERG


text: Our CISO provides the state-of-the-information security program to the Board annually and as needed. Also, our CISO and CFO meet with the chairman of the Audit Committee on an as-needed basis for a comprehensive analysis of the material risks in information security.

companyName: AdTheorent Holding Company, Inc.


text: The Company maintains a governance structure to address cybersecurity risk, which involves a dedicated Security Operations Team (the "Security Operations Team"), an executive security steering committee (the "Executive Security Steering Committee"), and the Compliance and Risk Committee of the Board and the Board.

companyName: DraftKings Inc.

ticker: DKNG


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to our Information Technology Steering Committee, Audit Committee and to our board of directors. Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information.

companyName: SMARTFINANCIAL INC.

ticker: SMBK


text: During the past three years, there have been no material impacts from cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition. Despite our security architecture and controls, and those of our third-party providers, we may be vulnerable to cyber-attacks, computer viruses, security breaches, ransomware attacks, inadvertent or intentional employee actions, system failures, and other risks that could materially impact our financial results and our results of operations.

companyName: Ingevity Corp

ticker: NGVT


text: Our Information Security Officer ("ISO") coordinates with other members of our Incident Response Team identified in our Information Security Program to document, validate, respond, and manage actual or potential security incidents according to their threat classifications as described above, and report to our board of directors and/or the Audit Committee on an ad hoc basis. The ISO also provides annual reports on the status of our Information Security Program and its compliance with regulatory requirements to our board of directors in connection with our board's general risk management oversight role, as described in further detail below. The ISO is responsible for overseeing day-to-day operations of the Information Security Program, coordinating or contributing to reviews, audits, risk assessments, and other risk management material, development of departmental policies and procedures for board approval, and periodic updates to our Information Technology Steering Committee and/or the Board of Directors Technology Committee. The ISO reports to the Senior Risk Officer.

companyName: Community West Bancshares

ticker: CWBC


text: The Board of Directors is responsible for overseeing the Company's cybersecurity program. The Board of Directors has established oversight mechanisms that are intended to promote effective governance in managing risks associated with cybersecurity threats because it recognizes the significance of these threats to the Company's operational integrity and the information stored on the Company's information systems or those of third-party service providers. See "—Governance— Board of Directors Oversight."

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: Assessment, Identification and Mitigation of Cybersecurity Threat Risk Our cybersecurity threat strategy is based on prevention, detection and mitigation using layered defenses, continuous assessment and monitoring, vulnerability scans, end-point detection and response and regular defense testing through simulations, penetration tests and table top exercises. While our cybersecurity policies, practices and programs may vary by location or by service, our overall cybersecurity risk management program leverages the ISO 27001 framework. Our Information Security Office regularly monitors alerts and threat levels, trends, and remediation efforts, conducts post-incident reviews, conducts maturity testing to assess our processes and procedures and the threat landscape, reviews our operational policies and procedures, and conducts an annual risk assessment as described above. We believe that these steps are useful tools in identifying and assessing risks, giving our team key information and insights used to manage those risks to help protect our clients, families, employees, vendors, investors, and our data and intellectual property.

companyName: BRIGHT HORIZONS FAMILY SOLUTIONS INC.

ticker: BFAM


text: Management, led by the Chief Information Security Officer (the "CISO"), plays a crucial role in assessing and managing cybersecurity risks. The CISO holds a Master of Science in Information Security and Assurance along with other technical certifications, has over 20 years of experience in cybersecurity and has extensive experience managing cybersecurity programs in multinational manufacturing companies. The IT Risk Management Committee, under guidance of the CISO, oversees the assessment and mitigation of identified risk. Regular reporting mechanisms keep the Board of Directors of the Company informed about our cybersecurity posture and emerging risks; enabling informed decision-making regarding cybersecurity strategy and resource allocation.

companyName: KENNAMETAL INC

ticker: KMT


text: Our program includes procedures to oversee and identify cybersecurity risks and threats of our third-party service providers, which include third-party evaluations performed by our team of information security professionals, review of independent assessment documentation, and continuous monitoring of third-party independent posture scoring. We also include security and data protection provisions in our contractual arrangements with third-party service providers where applicable. Additionally, we have purchased a cybersecurity risk insurance policy that would reduce the costs associated with a covered cybersecurity incident if it occurred.

companyName: Avantor, Inc.

ticker: AVTR


text: Role of Management Our senior management, with the oversight of the Board, is responsible for the day-to-day management of the material risks the Company faces, including those related to cybersecurity. We believe it is important to work at all levels of the Company's hierarchy to manage cybersecurity risks and threats. Therefore, all users must use an online IT ticketing system, which is monitored around the clock, to report any incidences. Qualified individuals in IT determine what resources to allocate to each case and escalation of an incident, if deemed necessary. The Systems Administrators and IT Director, who has more than 17 years of experience with the Company, communicates on a day-to-day basis with the Chief Financial Officer and President/Chief Operating Officer who would bring any material cybersecurity issues to the attention of the Company's Chief Executive Officer and the Board.

companyName: NATURAL ALTERNATIVES INTERNATIONAL INC

ticker: NAII


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any cybersecurity threats, that have materially affected or are likely to affect us, including our business strategy, results of operations or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the “Risk Factors” disclosures in Item 1A of this Annual Report on Form 10-K.

companyName: Maze Therapeutics, Inc.

ticker: MAZE


text: As a critical component of our cybersecurity risk management program, we have strategically integrated cybersecurity risk management into our broader enterprise risk management function to cultivate a company-wide culture of cybersecurity risk management. Our program has been designed and evaluated based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). We use the NIST CSF as a guide to identify, assess, and manage cybersecurity risks relevant to our business. Additionally, given that we accept credit cards as a form of payment, we consider the requirements of the Payment Card Industry Data Security Standards (PCI DSS) as part of our cybersecurity risk management program.

companyName: CRACKER BARREL OLD COUNTRY STORE, INC

ticker: CBRL


text: Our CIO and CISO communicate directly with members of the Audit Committee and Board of Directors on cybersecurity matters. In 2023, our CIO and CISO presented updates on our cybersecurity initiatives quarterly; twice to our Audit Committee and twice to our full Board.

companyName: NVR INC

ticker: NVR


text: The cybersecurity group holds periodic meetings and reviews metrics it deems appropriate, including any incidents and threats, and the current state of cybersecurity issues and threats in the industry. These efforts include developing a threat model that assesses potential damage to the Company's business and the likelihood of threat. We test the risk prioritization rankings of our threat model with external data about breaches and incidents reported by governmental agencies, including the Cybersecurity and Infrastructure Security Agency and National Security Agency. The Company partners with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes as needed.

companyName: New Fortress Energy Inc.

ticker: NFE


text: We design and assess our program based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: iHeartMedia, Inc.

ticker: IHRT


text: We have developed and implemented a cybersecurity risk management program, which includes administrative, technical and physical safeguards designed to maintain the confidentiality, integrity and availability of company and customer information. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas, including the involvement of cross-functional teams and, depending on the nature and severity of an incident, an escalation path to notify our executive and senior management teams and our board of directors (Board). We have an established process and playbook led by our chief information security officer (CISO) governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident. We undertake periodic reassessments of the Company's risk profile and may make certain adjustments to our security controls based on such assessments to further enhance our security posture.

companyName: DigitalOcean Holdings, Inc.

ticker: DOCN


text: In the event of a potential cybersecurity incident, the CIRT will conduct an assessment to determine the nature and scope of the incident and manages the incident in accordance with our incident response plan until the incident is contained and resolved. The CIRT will document findings and make them available to the Disclosure Committee, which includes cross functional senior management representation from information technology, legal, finance, investor relations and business segments. The Disclosure Committee, in conjunction with third-party experts, including outside legal counsel, is responsible for assessing the materiality of any cybersecurity incident and coordinating external communications and disclosures, including with the Securities and Exchange Commission.

companyName: Ecovyst Inc.

ticker: ECVT


text: We believe cybersecurity is critical to our mission achievement to ensure uninterrupted business continuity, and enables us to deliver superior services while safeguarding our customers' sensitive information.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: Cyber Incident Response Plan The Company has adopted a written Cyber Incident Response Plan (the "Plan") to guide our response to cybersecurity incidents. The Plan established the Cyber Incident Response Team ("CIRT"), which is responsible for leading the Company's response in the event of a cybersecurity incident and is comprised of the Company's Chief Technology Officer ("CTO") and Chief Operating Officer as well as other senior management.

companyName: PJT Partners Inc.

ticker: PJT


text: Oversight of Risk Management Generally Our Board has extensive involvement in the oversight of risk management related to us and our business. The Board accomplishes this oversight both directly and through its Audit Committee, Compensation Committee, Nominating and Corporate Governance Committee, and Privacy, Security and Technology Committee, each of which assists the Board in overseeing a part of our overall risk management and regularly reports to the Board. The Audit Committee represents the Board by periodically reviewing our accounting, reporting and financial practices, including the integrity of our financial statements, the oversight of administrative and financial controls, our compliance with legal and regulatory requirements and our policies with respect to risk assessment and risk management. Through its regular meetings with management, including the finance, legal and internal audit functions, the Audit Committee reviews and discusses significant areas of our business and related risks and summarizes for the Board areas of risk and any mitigating factors. The Compensation Committee considers, and discusses with management, management's assessment of certain risks, including whether any risks arising from our compensation policies and practices for our employees are reasonably likely to have a material adverse effect on us. The Nominating and Corporate Governance Committee oversees and evaluates programs and risks associated with Board organization, membership and structure, succession planning and corporate governance. In addition, our Board receives periodic detailed operating performance reviews from management. The Privacy, Security and Technology Committee, represents the Board by periodically reviewing and discussing with Company management the Company's major risk exposures relating to privacy, cybersecurity, and technology, and the steps the Company takes to detect, monitor, and actively manage such exposures.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: If a cybersecurity incident were to occur, including a cybersecurity incident associated with one of our third-party providers, we have developed an incident response plan to align responsibilities throughout the organization to facilitate an efficient and effective response, as well as an appropriate investigation of each incident. The incident response plan is led by executive management, the Chief Information Officer, the Corporate Vice President, IT Infrastructure Operations and Security, and our information technology department and includes a further delegation of incident responsibility to key internal stakeholders, including the legal, investor relations, human resources, and internal audit departments. Upon identification of an incident, each incident is assigned an incident materiality rating based on both quantitative and qualitative considerations. Qualitative considerations include the presence of ransomware, operational degradation or interruption, operational loss, and sensitive or confidential data loss. Based on the severity of each incident, the incident response is escalated. Cybersecurity incidents, regardless of materiality, are investigated by the information technology department led by Corporate Vice President, IT Infrastructure Operations and Security and are communicated to the Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Information Officer, the Chairman of the Board of Directors and the Chair of the Audit Committee. The entire Board of Directors is notified of material or high risk incidents.

companyName: CEDAR FAIR L P


text: Information Security Policies We maintain information security policies that are formally reviewed and approved by senior management and are periodically updated for new developments. These policies map to standard industry frameworks such as the National Institute of Standards and Technology (NIST), Committee of Sponsoring Organizations (COSO), and International Organization for Standardization (ISO) 27001 to establish structured governance, policies, standards, and controls.

companyName: Paylocity Holding Corp

ticker: PCTY


text: Our executive team and board of directors recognize that effective cybersecurity risk management is critical to the safety and security of our data, systems, and products and, ultimately, the long-term success of the Company. We have a comprehensive multi-layered cybersecurity risk assessment program, which covers the identification, analysis, evaluation, and management of cybersecurity risks. The program is cross-functional involving the participation and input of internal stakeholders, third-party consultants, and board oversight. The program is reviewed and updated on a semi-annual basis, or sooner if needed.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: The Bank's IT Steering Committee, comprising the ISO and members of the Company's executive management and IT department, generally meets on a monthly basis to review developments regarding the Company's cybersecurity risks, defenses and remediation activities. Minutes of the meetings of the IT Steering Committee are regularly reviewed by our Board of Directors.

companyName: Finwise Bancorp

ticker: FINW


text: The Company partners with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes, including periodic penetration tests, annual compliance risk assessments, and third-party cybersecurity assessments. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "Data security breaches, loss of data and other disruptions could compromise sensitive information related to our business or our members, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation." in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: Cano Health, Inc.


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Beam Therapeutics Inc.

ticker: BEAM


text: Internally, we also have a security awareness program which includes training that reinforces our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The security awareness program offers training on how to identify potential cybersecurity risks and protect our resources and information. These trainings are mandatory for all employees and take place throughout the year, and it is supplemented by testing initiatives, including periodic phishing tests. We also provide access to specialized training for certain employee roles, such as application developers. Finally, our privacy and data protection program requires all employees to take periodic awareness training on data privacy. This training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.

companyName: Rush Street Interactive, Inc.

ticker: RSI


text: Leveraging threat intelligence and other signals, the Company undergoes periodic testing, audits and reviews of its policies, standards, processes and practices to identify, assess and address cybersecurity risks and events. The Company also undergoes routine internal and external penetration testing. The results of such tests and assessments are evaluated by management and periodically reported to the Audit Committee. The Company further adjusts its cybersecurity policies, standards, processes and practices based on these results. The Company also makes available to clients attestations of its various certifications, audits, and penetration tests.

companyName: FAIR ISAAC CORP

ticker: FICO


text: Company's board of directors is responsible for overseeing and approving our cybersecurity strategy and policies. Our board of directors receives updates from management on the Company's cybersecurity status and initiatives and provides guidance and feedback on the cybersecurity goals and objectives. Our board of directors also monitors the Company's cybersecurity risks and exposures and ensures that the company has adequate cybersecurity resources and capabilities to protect its data and systems.

companyName: Mitesco, Inc.

ticker: MITI


text: Our second line of defense includes our Cybersecurity Committee and the enterprise risk-management framework under the direction of the Chief Risk Officer to monitor cybersecurity functions and risk management. In addition to the COO, CIO and Director, Information Security, our Cybersecurity Committee is composed of members of management including, but not limited to, the Chief Risk Officer, General Counsel and Vice President, Internal Audit. The Cybersecurity Committee helps ensure corporate policy compliance and reports directly to the Board of Directors regarding material cybersecurity incidents and emerging threats.

companyName: NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

ticker: NRUC


text: The CISO, under the guidance of our CIO, CRO, CEO and General Counsel, works collaboratively across the Corporation to implement a program designed to protect the Corporation's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Corporation's incident response and recovery plans including an assessment of the potential materiality of any cybersecurity incident. To facilitate the success of the Corporation's cybersecurity risk management program, multidisciplinary teams throughout the Corporation are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and the 2nd Line Information Security Risk Management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Corporate Crisis Management Team and ultimately the ERC when appropriate.

companyName: ASSOCIATED BANC-CORP

ticker: ASB


text: We maintain internal resources to perform penetration testing designed to simulate evolving tactics and techniques of real-world threat actors, engage with industry partners and law enforcement and intelligence communities and conduct tabletop exercises and periodic risk interviews across our business. We also engage an independent third party to periodically perform internal and external penetration testing of Chipotle's information security environment and engage other third parties to periodically conduct assessments of our cybersecurity capabilities. In addition, we continue to expand training and awareness practices to mitigate risk from human error, including mandatory computer-based training and internal communications for employees. Our employees undergo cybersecurity awareness training and regular phishing awareness campaigns that are based upon and designed to emulate real-world contemporary threats. We provide prompt feedback (and, if necessary, additional training or remedial action) based on the results of such exercises.

companyName: CHIPOTLE MEXICAN GRILL INC

ticker: CMG


text: The Company's information security group monitors the Company's information systems to prevent, detect, mitigate, and remediate cybersecurity incidents. The Company uses tools and techniques to continually assess and monitor, manage and mitigate cybersecurity threats to its IT systems in a manner consistent with industry practice. The Company engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to obtain current threat intelligence, collaborate on security enhancements, and evaluate and improve the effectiveness of its information security program. As part of this program, the Company conducts periodic tabletop exercises to assess its cybersecurity incident response processes. The Company also maintains vendor management diligence and oversight processes to identify and monitor potential risks from cybersecurity threats attendant to its use of third-party service providers. Additionally, the Company monitors cybersecurity threat intelligence received from key third-party service providers associated with the Company.

companyName: Merck & Co., Inc.

ticker: MRK


text: BDT & MSD use processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, BDT & MSD use systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, BDT & MSD also maintain an incident response plan that is utilized when cybersecurity incidents impacting us are detected. BDT & MSD also require that all employees, including employees of BDT & MSD complete interactive security awareness training on an annual basis.

companyName: MSD Investment Corp.


text: If a cybersecurity incident were to occur, including a cybersecurity incident associated with a third-party provider, management has developed an incident response plan to align responsibilities throughout the organization to facilitate an efficient and effective response, as well as an appropriate investigation of each incident. The incident response plan is led by executive management, the Chief Digital and Technology Officer, the Corporate Vice President, IT Infrastructure Operations and Security, and the information technology department and includes a further delegation of incident responsibility to key internal stakeholders, including the legal, investor relations, human resources, and internal audit departments. Upon identification of an incident, each incident is assigned an incident materiality rating based on both quantitative and qualitative considerations. Qualitative considerations include the presence of ransomware, operational degradation or interruption, operational loss, and sensitive or confidential data loss. Based on the severity of each incident, the incident response is escalated. Cybersecurity incidents, regardless of materiality, are investigated by the information technology department led by Corporate Vice President, IT Infrastructure Operations and Security and are communicated to the Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Digital and Technology Officer, the Executive Chairman of the Board of Directors, Lead Independent Director and the Chair of the Audit and Finance Committee. The entire Board of Directors is notified of material or high-risk incidents.

companyName: Six Flags Entertainment Corporation/NEW

ticker: FUN


text: The Company regularly confronts cyber risks, threats and incidents, any one of which could have a material impact on the Company, including its business strategy, results of operations or its financial condition. If the Company experiences a cybersecurity incident requiring a response, it has a Computer Incident Response Plan, which defines response protocols, resource allocations and personnel engagement depending on severity level. Executive leadership, including the CEO, would be engaged in the event of an incident at certain severity levels and the CEO would engage members of the Company's board of directors as appropriate. The Cybersecurity Department would also utilize third-party experts and consultants it has on retainer, depending on the nature of the incident.

companyName: DARLING INGREDIENTS INC.

ticker: DAR


text: Our Information Technology department, under the leadership of our Vice President of Information Technology, or VP of IT, and with cross-functional internal and third-party support, helps identify, assess and manage our cybersecurity threats and risks. The Information Technology department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our and our industry's risk profile using various methods, including, for example, regular threat assessments (including through interaction with law enforcement when necessary), internal and external audits, threat environment scans and third-party threat assessments, vulnerability assessments, external intelligence feeds and third-party-conducted tabletop training exercises.

companyName: Vital Farms, Inc.

ticker: VITL


text: Entergy and the Registrant Subsidiaries maintain access-management controls, including a layered multi-factor authentication process for network and system access, and a defense-in-depth security ecosystem that includes advanced threat detection from independent third parties and federal agencies, security logging and monitoring, and independent third-party penetration and vulnerability assessments. Relevant employees and contractors must complete cybersecurity trainings periodically to heighten security and threat awareness, promote best practices, and meet regulatory requirements. Additional multi-layered prevention and detection processes and technologies to mitigate and minimize the effects of cybersecurity risks include email security, continuous monitoring, vulnerability scanning, anti-virus and anti-malware software, backups and recovery strategy, network segregation, third-party security, and information protection.

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. We devote appropriate resources and designate members of our management, including our Chief Executive Officer and Chief Financial Officer, to manage the risk assessment and mitigation process.

companyName: Sharplink, Inc.

ticker: SBET


text: At the management level for Southwest Gas, our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by Southwest Gas' President and the Vice President/Information Services/Chief Information Officer, along with the Director of Information Security. A Cybersecurity Executive Committee, consisting of officer-level management appointees representing key areas of our business, exists to maintain situational awareness of cybersecurity risks, support methods of addressing cybersecurity risks, and support the Chief Information Officer's efforts to help Southwest Gas follow natural gas sector-specific regulations and reporting. The Cybersecurity Executive Committee meets regularly with legal advisors and cybersecurity professionals. In our Information Services department, the cybersecurity management team members hold degrees in information technology or cybersecurity and industry-recognized certifications in cybersecurity, and each has many years of relevant work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. Cybersecurity team members are expected to keep their knowledge, skills, and training current by participating in industry events and continuing education programs as applicable.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: We have established policies to govern the security of our systems and the protection of customer and patient data, which include regular system updates and patches, employee training on cybersecurity and HIPAA best practices, incident reporting, and the use of encryption to secure sensitive information. Our Cybersecurity department, which reports to our VP of Cybersecurity, is responsible for our cybersecurity program and our Global Risk & Integrity department, which reports to our CRO, is responsible for our privacy program as further discussed below. To identify, assess, and manage material cybersecurity risks, our Cybersecurity team uses a cybersecurity risk assessment process aligned with leading frameworks such as the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework and HIPAA. To ensure appropriate and consistent risk evaluation and decision-making processes among our Cybersecurity and Global Risk & Integrity departments, we utilize an Adjusted Risk Rating ("ARR") system that considers certain attributes that represent impact to the Company, and we prioritize our actions based on our ARR system. Our cybersecurity risk assessment program provides the underlying basis for the activities our Cybersecurity and Global Risk & Integrity departments take to identify and mitigate risks from, as well as develop risk management and response strategies for, evolving and emerging cybersecurity threats.

companyName: iRhythm Holdings, Inc.

ticker: IRTC


text: Process Recursion's approach to InfoSec is informed by the National institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), which is a broad standards framework that provides direction and guidance to assess the Company's InfoSec risk and implement InfoSec capabilities, and also provides measures of progress in areas that are relevant for the organization's business objectives.

companyName: RECURSION PHARMACEUTICALS, INC.

ticker: RXRX


text: The Companies maintain a robust, tested and regularly revised Cyber Security Incident Response Plan and a Vendor Compromise Response Plan. These plans detail roles, responsibilities and actions to be taken in response to a detected event whether internal or associated with a third-party service provider. The plans provide clear direction for escalation of information to leadership, including Dominion Energy's Board of Directors as appropriate, and drive collaboration amongst relevant members of management representing cybersecurity, information technology, operations, supply chain, legal and accounting departments. As necessary, the COO, CFO and chief legal officer will advise the CEO on any incidents which could potentially have a material effect on the Companies' business operations, results of operations or financial condition.

companyName: VIRGINIA ELECTRIC & POWER CO


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents, and the expenses we have incurred from cybersecurity incidents have been immaterial.

companyName: WILLIAMS SONOMA INC

ticker: WSM


text: To protect our IT systems and information from cybersecurity risks, we, through our third-party provider, use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified cybersecurity vulnerabilities and incidents in a timely manner. These include the utilization of a third-party security operations center connected to a network operation center to identify, investigate, and resolve any cybersecurity threats and incidents.

companyName: EMPIRE PETROLEUM CORP

ticker: EP


text: Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our employee, business or customer data.

companyName: TIDEWATER INC

ticker: TDW


text: As an international service provider, our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected, the Director of IT, Head of Resource Management, and CCO consult with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we then, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: implementation of industry-leading Cloud solutions and business applications which possess integrated cybersecurity safeguards; anti-malware, antivirus, and threat detection software; ransomware containment and isolation software; enhanced password requirements and multifactor authentication requirements; endpoint encryption; intrusion detection and response system conduct file integrity monitoring; email archiving, firewalls, and quarantine capabilities; mobile device management of business applications; frequent systems backups with recovery capabilities; and regular vulnerability scans and penetration testing.

companyName: GLADSTONE LAND Corp

ticker: LAND


text: The Director of IT leads the day-to-day management of cybersecurity at Genasys, supported by a team of three IT professionals with a combined 45 years of IT and cybersecurity experience. This team handles ongoing risk assessments, manages threat detection through our SOC and Security Information and Event Management (SIEM), ensures compliance with industry regulations, and informs executive management about ongoing efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means. This may include briefings from internal security personnel; sharing publicly or privately available threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and forwarding alerts and reports produced by network monitoring and security tools we deploy. Management also ensures that employees and contractors undergo quarterly cybersecurity training and phishing simulations via KnowBe4, as part of a comprehensive awareness program.

companyName: Genasys Inc.

ticker: GNSS


text: Oversight of Third-Party Risks Our third-party service providers, suppliers, and vendors face their own risks from cybersecurity threats that could impact Bioventus in certain circumstances. We have implemented processes for overseeing and managing these risks. Those processes include assessing the third parties' information security practices before allowing them to access our information systems or data, requiring the third parties to implement appropriate cybersecurity controls and otherwise agree to contractual requirements designed to address cybersecurity risks in our agreements with them, and conducting ongoing monitoring of their compliance with those requirements.

companyName: Bioventus Inc.

ticker: BVS


text: Third-party risk is assessed as part of our information security program and includes risk-tiered criteria for due diligence. Contractually, data handling third parties are required to uphold all applicable rules, laws, and regulations in addition to, when applicable, notifying us of cybersecurity events that may negatively impact us or our data.

companyName: Regional Management Corp.

ticker: RM


text: As part of the Company's overall risk assessment process, the enterprise risk management framework considers cybersecurity risk alongside other company risks. The Company's internal audit department collaborates with the Company's information technology department to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations. The Company actively engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to evaluate and enhance the effectiveness of its information security policies and procedures. Additionally, the Company provides cybersecurity awareness training to its employees, incident response personnel, and senior management.

companyName: MP Materials Corp. / DE

ticker: MP


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, our operations, business strategy, results of operations, or financial condition. However, we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, our operations, business strategy, results of operations, or financial condition. See Item 1A "Risk Factors".

companyName: ENERPAC TOOL GROUP CORP

ticker: EPAC


text: Management roles and responsibilities of Superior's cybersecurity incident management are defined within the Company's IR plan. The plan includes the formation of the Security Incident Response Team responsible for leading incident response. In the event of specific cybersecurity incidents, defined sub-teams are engaged, as necessary, to monitor the mitigation and remediation of cybersecurity incidents. These sub-teams are comprised of cross-functional experts including, but not limited to, legal, accounting, operational and IT leadership and relevant external counsel.

companyName: SUPERIOR INDUSTRIES INTERNATIONAL INC

ticker: SSUP


text: The Bank recognizes the need for sound physical and internal controls over its critical financial data, confidential information and digital assets to ensure the accuracy, integrity, and confidentiality of the processed information. As regulated financial institutions, the Company and Bank are also subject to financial privacy laws and their cybersecurity practices are subject to oversight by the federal banking agencies.

companyName: Home Federal Bancorp, Inc. of Louisiana

ticker: HFBL


text: We follow incident response and breach management processes that principally consist of four interrelated steps to identify and assess material risks from cybersecurity threats: (1) preparing for a cybersecurity incident; (2) detecting and analyzing a cybersecurity incident; (3) containing, eliminating and recovering from the cybersecurity incident; and (4) analyzing the cybersecurity incident after it is resolved. We assess, rank and prioritize cybersecurity incidents based on their severity and impact on our operations and business. Our information security team, with assistance from our legal team, oversees cybersecurity incident response and breach management processes and commencing with the formation of the Board's Cybersecurity Special Committee, reports to such committee.

companyName: ARKO Corp.

ticker: ARKO


text: Network and Device Security The Company employs a constantly evolving, defense-in-depth methodology to cybersecurity. Robust high-availability firewalls are in place at the perimeter. Remote workers are supported through the Company's secure virtual private network (VPN) and uses multifactor authentication. The Company has a vulnerability management program in place that includes a managed detect and response platform to ensure monitoring of the Company's network, ensures the timely installation of software patches, and provides a risk-based approach to addresses vulnerabilities across the network. Network security controls are in place to prevent unauthorized access to the network or the Company's IT resources. The Company employs controls over its managed workstations, servers, and other endpoints to prevent inappropriate access or damage to physical, virtual, or data assets. Data loss prevention programs are in place to prevent the inappropriate transmission or exposure of sensitive data assets or customer information.

companyName: FIRST BANCSHARES INC /MS/


text: We maintain an IRP, which provides a set of core practices and procedures when responding to certain high-risk information security threats and incidents, and a CMP, which is designed to ensure appropriate resources are utilized to provide an effective, timely, and coordinated response in managing crises, including significant cyber threats and incidents. Among other things, the IRP sets forth roles and responsibilities in connection with detecting, assessing, and mitigating cybersecurity incidents and outlines applicable communication and escalation protocols. Under the CMP, our Crisis Management Committee will assume overall responsibility in an effort to ensure that the appropriate functions and work streams are mobilized and coordinated to effectively manage any significant cyber events.

companyName: CONSTELLATION BRANDS, INC.

ticker: STZ


text: The Company engages reputable third parties to conduct various risk assessments on a regular basis, including but not limited to maturity assessments and various security system testing. Following a defense-in-depth strategy, the Company leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.

companyName: Third Coast Bancshares, Inc.

ticker: TCBX


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, penetration testing firms, threat intelligence service providers, dark web monitoring services, and cybersecurity consultants.

companyName: CS Disco, Inc.

ticker: LAW


text: Our cybersecurity risk assessment and management processes provide for regular updates to the Audit & Risk Committee. The Audit & Risk Committee receives reports from our Executive Vice President, Technology and our General Counsel concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit & Risk Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: STARZ ENTERTAINMENT CORP /CN/

ticker: STRZ


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our overall business strategy, results of operations, or financial condition over the long term. However, there can be no assurance that we, our hotel owners, our third-party service providers, or other companies with whom we do business, will not experience a cybersecurity threat or incident in the future that could materially adversely affect our business strategy, results of operations, or financial condition. See the discussion about the Starwood Data Security Incident under the "Litigation, Claims, and Government Investigations" caption in Note 7 to our financial statements, the discussion of the same in Part II, Item 7, "Management's Discussion and Analysis of Financial Condition and Results of Operations," and the discussion of cybersecurity risk in Part I, Item 1A, "Risk Factors."

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: Our cyber security policies and procedures are reviewed and updated annually or as needed to address any emerging threats and changes in regulatory requirements.

companyName: Lodging Fund REIT III, Inc.


text: Cybersecurity incidents may create risk to the Company that may impact its reputation, financial performance, ability to operate safely or at all, and the value of its intellectual property. Like most corporations, the Company is the target of industrial espionage, including cyberattacks, from time to time. The Company has determined that these incidents have resulted, and could result in the future, in unauthorized parties gaining access to certain confidential business information. However, to date, the Company has not experienced any known cybersecurity incidents that have materially affected the Company, including the Company's results of operations and financial condition, changes in the competitive environment, business operations and strategy. Although management does not believe that the Company has experienced any material losses to date related to cybersecurity incidents, there can be no assurance that the Company will not suffer such losses in the future. For more information on potential risk related to cybersecurity incidents, including intellectual property theft and operational disruption, please see "Item 1A – Risk Factors" of this report.

companyName: Bankwell Financial Group, Inc.

ticker: BWFG


text: We employ processes incorporated into our overall risk management system for assessing, identifying, and managing material risks from cybersecurity threats. These items are designed to help protect our information assets from internal and external threats and protect the integrity and confidentiality of our data.

companyName: Kraig Biocraft Laboratories, Inc.

ticker: KBLB


text: We have implemented a number of security measures designed to protect our systems and data, including firewalls, antivirus and malware detection tools, patches, log monitors, and routine back-ups,. In addition, we have continued our efforts to migrate our platforms to cloud-based computing, which is designed to further strengthen our security posture.

companyName: NEXGEL, INC.

ticker: NXGL


text: Our Chief Technology Officer leads cybersecurity risk management improvement initiatives as part of our technology strategy, coordinated and monitored by experts from our Technology Leadership Centre. In contrast, the program's implementation at our subsidiaries is largely delegated to the subsidiary staff. Significant subsidiaries at least annually provide updates on their implementation progress, significant cybersecurity incidents, and risks to their senior executives and the experts from our Technology Leadership Centre. The experts periodically consolidate and analyze information about the cybersecurity risk management program, cybersecurity incidents and risks, key initiatives, and other matters relating to cybersecurity processes for reporting to our Chief Technology Officer and our Chief Risk Officer. Both officers at least quarterly report to the Risk Committee of the board of directors. Our Chief Technology Officer also at least annually reports directly to the board of directors including on cybersecurity initiatives, notable incidents, and risks. Our Chief Risk Officer at least annually reports directly to the board of directors including on cybersecurity incidents and risks.

companyName: Freedom Holding Corp.

ticker: FRHC


text: (v) monitoring for cybersecurity-related legal or regulatory developments; coordinating with management, our IT Provider and /or legal counsel to discuss cybersecurity-related issues or topics; and (vi) reviewing and updating our policies as necessary and on an annual basis.

companyName: Gaucho Group Holdings, Inc.


text: Our data breach management policy classifies potential threats by risk levels, and we typically prioritize our threat mitigation and impact evaluation efforts based on those risk classifications, while focusing on maintaining the resiliency of our systems. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks.

companyName: Bally's Corp

ticker: BALY


text: The Company regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and tests those systems pursuant to the Company's cybersecurity policies, standards, processes, and practices, which are integrated into the Company's overall risk management program. We have adopted aspects of the NIST cybersecurity framework, to which risk management in relation to our information systems is aligned. We categorize our information systems as either Tier 1 (critical) or Tier 2 or Tier 3 (essential), depending on business value and/or risk of financial or compliance impact of cybersecurity incidents. Our information security team uses a multifaceted approach to monitor, assess, identify, and manage material risks to the Company from cybersecurity threats, including testing of the effectiveness of our cybersecurity incident prevention and response systems; conducting routine vulnerability scanning of information systems assets; network/endpoint detection and response coupled with advanced identification-enhanced logging capabilities powered by artificial intelligence software; discovery through collaboration with the Company's internal audit team; monitoring of threat intelligence feeds provided by industry associations/groups, service providers, and federal/state authorities; and professional service engagements, such as retaining the services of an external 24/7 security operations center and partnering with third parties in testing our information systems for vulnerabilities from external, internal, and social engineering perspectives and assessing the effectiveness of our cybersecurity controls.

companyName: SB FINANCIAL GROUP, INC.

ticker: SBFG


text: We face considerable cybersecurity risk due to constant and relentless efforts by cybercriminals to exploit physical, human, and technological vulnerabilities in order to gain access and control of our networks, data, and intellectual property. Constantly evolving technology and the planning, methodologies, and strategies these attackers utilize to capitalize on vulnerabilities in systems put us at a disadvantage. Although, we have not encountered a cybersecurity threat or incident that resulted in a material impact on our business, operations or financial condition, there is no assurance that we will not experience such an event in the future. We are committed, however, to maintaining vigorous oversight of these risks.

companyName: ATRION CORP


text: The Board, in coordination with the ESCR Committee, is responsible for the oversight of risks from cybersecurity threats. The responsibilities of the ESCR Committee include overseeing policies and management systems for cybersecurity matters and reviewing CNX's strategy, objectives, and policies relative to cybersecurity. In addition, the Board and the ESCR Committee receive regular presentations and reports on cybersecurity risks that address a wide range of topics, including recent developments, personnel changes, discussion of testing and vulnerability assessment efforts, technological trends or tools, third party updates, and regulatory standards. The CNX IRP calls for prompt and timely direct notifications and updates to the Board (or its committees) as necessary in connection with any cybersecurity incidents that may occur. On a periodic basis, the Board and the ESCR Committee discuss our approach to cybersecurity with our CIO and Director of Cybersecurity.

companyName: CNX Resources Corp

ticker: CNX


text: Our information technology functions identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including internal and external audits, penetration and vulnerability tests, automated tools, subscriptions to reports and services that identify cybersecurity threats, analysis of reports of threats and actors, use of external intelligence feeds, evaluations of our and our industry's risk profile, evaluation of threats reported to us, threat assessments for internal and external threats, scans of internal systems for threats and incident response simulations (including third-party-conducted tabletop incident response exercises). We engage certain external service providers, including consultants, independent privacy assessors and computer security firms, as appropriate, to assess, test or otherwise assist with aspects of our security controls, including cybersecurity incident containment and remediation efforts, and enhance our cybersecurity oversight. We also use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example penetration testing firms, cybersecurity consultants, forensic investigators, cybersecurity software providers, managed cybersecurity service providers and professional services firms (including legal counsel).

companyName: Immunovant, Inc.

ticker: IMVT


text: We recognize the importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. This process is supported by both our management and our Board of Directors.

companyName: SMITH A O CORP

ticker: AOS


text: As discussed further under the heading "Cybersecurity Governance," Apollo's Board of Directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer (" CISO ") and the Chief Information Security Officer of Athene Holding Ltd. (" AHL's CISO "), a subsidiary of Apollo, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, and also receive support, as appropriate, from our executive officers and other representatives of the Operating Manager and its affiliates.

companyName: Apollo Infrastructure Co LLC


text: In addition, we engage specialized consultants and third-party managed service providers on a project-specific basis to assist us with projects that will improve our IT infrastructure, strengthen our security posture, and improve our cyber readiness.

companyName: Silk Road Medical Inc


text: Our board of directors, led by the board's technology, innovation and operations committee, actively oversees our information security program, with our management providing that committee with regular updates (including at each of the four meetings held by that committee in 2023) and reporting on our IT strategy, including information security strategies and initiatives, event preparedness and incremental improvement efforts.

companyName: Essent Group Ltd.

ticker: ESNT


text: Our Cybersecurity team, comprised of seasoned IT and cybersecurity members, has decades of experience across multiple technical and compliance disciplines including cyber incident response, forensics, IT compliance, incident recovery, threat investigation and information technology. Our cybersecurity team includes several individuals who hold industry recognized certifications and advanced degrees in cybersecurity. Cybersecurity oversees the implementation and compliance of our information security standards, information technology compliance, and mitigation of information security related risks. The Chief Technology Officer (CTO) and Chief Information Officer (CIO) have direct oversight of the cybersecurity function. We also have management level committees, leaders, and a cybersecurity incident team who support our processes to assess and manage cybersecurity risk as follows: • The head of privacy, in conjunction with the cybersecurity leadership assists on identification and mitigation of privacy related risks across the enterprise. This combination brings together legal, compliance and other function leads as required. • The Cybersecurity Disclosure Steering Committee, comprised of leadership from IT, cybersecurity, operations, risk, finance, legal and compliance across business segments, contributes to the assessment of cybersecurity breach, planned response, and required disclosures and filings. • The Rapid Response Team, which includes senior executives across the Company and its global operations, is alerted as appropriate to cybersecurity incidents, natural disasters and business outages. The Rapid Response Team performs tabletop exercises on a yearly basis with inclusion across functions.

companyName: NEWMONT Corp /DE/

ticker: NEM


text: Our executive team including our Chief Executive Officer, and Chief Financial Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. This executive team is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: SPLASH BEVERAGE GROUP, INC.

ticker: SBEV


text: Key Program activities include: • Annual risk assessment to evaluate our profile against cyber risk threats; • Global policies based on the guiding principles of security by design and least-privilege access; • Maintenance of a critical incident response plan and simulation programs, which include procedures to comply with material security incident reporting requirements in collaboration with key members of Executive Management; • A communication framework designed to ensure that the individuals managing the Program are informed about, and in position to monitor the prevention, detection, mitigation, and remediation of, cybersecurity incidents; • Internal and external security assessments and testing to determine our susceptibility to compromise, lateral movement, privilege escalation and overall cybersecurity internal control posture; • Routine phishing simulations to identify areas for control enhancement and additional training; • Periodic end-user security training and cyber-threat awareness; • Suite of tools and processes to minimize the risk of security compromise in addition to detect controls alerting of potential malicious activity; and • Review and approval process focused on evaluating cybersecurity posture and internal controls relating to third party service providers.

companyName: TELEFLEX INC

ticker: TFX


text: Cybersecurity Risk Management and Governance Information security is an integral part of the Company's overall enterprise risk management program. The Company maintains cybersecurity processes designed to detect and assess the severity of cybersecurity threats and incidents and, where applicable and possible, to identify the source of a threat or incident, including, whether it is associated with the use of third-party service providers. The Company's processes also include cybersecurity testing, detection, response, prevention and mitigation strategies, conducting contract and vendor due diligence review, and informing management and the Company's Board of Directors of material cybersecurity threats and incidents. The Company's information security team also engages third-party security consultants for penetration testing, training and system enhancements. The Company provides training and education for employees on cybersecurity awareness, including confidential information protection and simulated phishing attacks where appropriate for the employee's role.

companyName: TIMKEN CO

ticker: TKR


text: Our Board of Directors is actively engaged in overseeing our cybersecurity and information security program. Our Board of Directors receives regular reports during board meetings from our CCO on our and our Adviser's and Administrator's efforts concerning information security and addressing information technology and cybersecurity risks, no less than quarterly. The reports are distributed to our Board of Directors, and our CCO engages in detailed discussions with the independent board members during the independent members' session. The reports cover all potentially material cybersecurity threats facing us, as well as key risks and mitigation efforts undertaken by us and our Adviser and Administrator. As significant threats or events are identified by management or the ISP between regular reporting periods, our CCO will inform our Board of Directors immediately and keep it informed as to the developments of assessing the risks, mitigating efforts, and potential disclosure. Appropriate members of management and third party providers will be involved as deemed necessary based on the potential impact.

companyName: GLADSTONE COMMERCIAL CORP

ticker: GOOD


text: The charter of the Audit Committee also provides that the Audit Committee may receive additional training in cybersecurity and data privacy matters to enable its oversight of such risks and that the Audit Committee will regularly report to the Board the substance of such reviews and discussions and, as necessary, recommend to the Board such actions as the Audit Committee deems appropriate.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: We have incorporated a number of technical, administrative and personnel controls in order to holistically address cybersecurity threats across the business.

companyName: Loar Holdings Inc.

ticker: LOAR


text: Due to the size of our company, we have not yet developed robust policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We have implemented access controls with respect to our systems, which we monitor regularly and audit annually. We currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems, including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. We rely on third party providers and outsourced IT services to monitor and address cybersecurity related risks, including installing software for threat protection and malware. Such third party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our board of directors to discuss if deemed necessary or appropriate. Based on the results of our risk assessments, if deemed necessary or appropriate, we take steps to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.

companyName: Tivic Health Systems, Inc.

ticker: TIVC