text: The Company is committed to securing our information technology systems, including accounting software and back-of-house software, against cybersecurity threats and protecting the privacy of the data of our customers, employees, and other business partners. We recognize that cybersecurity threats are an ongoing concern in today's digital world and that, despite devoting resources to secure our information technology systems, cybersecurity incidents can occur and, if so, could negatively impact our brand, business, results of operations and financial condition. Cybersecurity threats include any potential unauthorized occurrence on or conducted through our information technology systems or information technology systems of a third party that we utilize in our business that may result in adverse effects on confidentiality, integrity, or access to our information technology systems.

companyName: US NUCLEAR CORP.

ticker: UCLE


text: As part of our risk management process, the Company maintains an overall risk management program that encompasses cybersecurity, conducts security audits, annual System and Organization Controls (SOC 2) testing, and ongoing risk assessments using a company-wide risk framework. We also require employees with access to information systems to undertake data protection and cybersecurity training and compliance programs. Compliance with cybersecurity training is tracked and reported to the Company's Compliance Executive Steering Committee and the Audit Committee of the Board. In addition, the Company conducts quarterly employee phishing tests and our CISO provides those results to the Company's executives. The Company has processes in place for assessing, identifying, and managing material risks from potential cybersecurity incidents, including vulnerability identification, intrusion prevention, encryption, endpoint protection, behavior analysis, mitigation and the processes and protocols set forth in the Company's incident response plans. Certain of our subsidiaries manage their own cybersecurity functions and coordinate with the Company's CISO. The Company also employs systems and processes designed to oversee and identify cybersecurity threats associated with third-party vendors, including a risk assessment and rigorous evaluation of each vendor that may access, process or store highly sensitive or proprietary data or that is systematically integrated with the Company's systems or network. In addition to our in-house cybersecurity capabilities, we engage assessors, consultants, auditors, and other third parties to assist with assessing, identifying, mitigating and managing cybersecurity risks, including the maintenance of a Security Operations Center that is co-managed between the Company and a managed security service provider (MSSP), which continuously reviews the Company's network using threat intelligence from a variety of sources and reports potential incidents from users.

companyName: First American Financial Corp

ticker: FAF

secItem: Item 1C


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. See "Risk Factors—Risks Related to Employee Matters, Managing Our Growth and Other Risks Related to Our Business—Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."

companyName: Zentalis Pharmaceuticals, Inc.

ticker: ZNTL


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks We operate in an increasingly interconnected digital landscape and we recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats. In the normal course of business, we may collect and store certain sensitive information, including proprietary and confidential business information, intellectual property, sensitive third-party information, employee information and other personal information. We rely on our own information systems and third-party information systems for the management of this information in addition to our management of business processes including inventory, payment of obligations, collection of cash, human capital management, financial tools and other processes and procedures. Our ability to manage our business effectively depends on the reliability, security and capacity of these systems. We seek to address these risks by safeguarding assets, data, and operations through the cybersecurity risk management processes described below: Risk Assessment:

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: Our SIO provides management with periodic reports regarding cybersecurity and data privacy measures and procedures, the identification of security gaps and compliance with applicable cybersecurity and data privacy regulations. Management then briefs our board at scheduled meetings regarding cybersecurity and data privacy developments. Management and our SIO are responsible for day-to-day monitoring of the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: Investview, Inc.

ticker: INVU


text: As the investigation of the incident is ongoing, the full scope, nature and ultimate impact of the incident are not yet completely known. We have no current evidence that any personally identifiable information of any employees, customers, suppliers or vendors has been compromised, but our analysis and review of the potential compromised systems and data is continuing.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: Our audit committee, which reports directly to the board of directors, is responsible for overseeing our cybersecurity risk management program. The audit committee receives periodic updates on cybersecurity risks, mitigation strategies, and, in the event of a cybersecurity incident, incident response strategies from our Chief Financial Officer ("CFO"). The audit committee updates the full board of directors on matters relating to cybersecurity risk management and critical cybersecurity risks as appropriate.

companyName: Lifeward Ltd.

ticker: LFWD


text: Our approach to managing cybersecurity risk is informed by the industry-standard National Institute for Standards and Technology Cybersecurity Framework. The VP, CIS has primary responsibility for implementing and overseeing our enterprise-wide cybersecurity strategy, policy, architecture and processes. We use various tools and methodologies to identify and manage cybersecurity risk, including risk assessments and a vulnerability management program that includes periodic penetration testing. We have a third-party cyber risk management program that conducts assessments on third parties who integrate with our data, network, systems and applications. These tools and methodologies inform our remediation activities, which are tracked and reported to senior management.

companyName: NIKE, Inc.

ticker: NKE


text: The Company has implemented and maintains various information security processes designed to identify, assess and manage risks from cybersecurity threats to its computer networks, communication systems, hardware and software and its critical data and confidential information. These include conducting scans of the threat environment and conducting vulnerability assessments. The Company has also implemented and maintains various technical and physical measures to mitigate material risks from cybersecurity threats including incident detection and response, disaster recovery and business continuity plans, internal controls within the Company's accounting and financial reporting functions, data encryption, network security and access controls, including multi-factor authentication, as well as physical security. The Company also conducts cybersecurity awareness training annually for employees and provides cybersecurity updates during regularly scheduled meetings, that occur at a minimum monthly, throughout the year. These updates are designed to educate employees and to raise awareness of cybersecurity threats to reduce vulnerability as well as to encourage consideration of cybersecurity risks across all Company functions.

companyName: RETAIL OPPORTUNITY INVESTMENTS CORP


text: Cybersecurity matters are an important part of reporting to our board of directors, executive management team, risk committee and disclosure committee. From a board perspective, the audit committee oversees the company's cybersecurity efforts along with additional oversight from the entire board. Two members of the audit committee have obtained certifications in cybersecurity oversight. Each quarter, the chief information officer and chief information security officer report to the audit committee on cybersecurity risks and controls. Also occurring each quarter, the entire board, and our senior executive team, as appropriate, receives a comprehensive report from the chief risk officer on the status and management of risk and other metrics relative to identified tolerances and limits, risk assessments and risk plans. Additionally, the chief risk officer has direct access to all members of the board of directors and presents in person at board meetings twice each year.

companyName: CINCINNATI FINANCIAL CORP

ticker: CINF


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Risk and Compliance Committee (the "Audit Committee") oversight of cybersecurity, privacy and other information technology risks. The Audit Committee has responsibility for oversight of management's implementation of our cybersecurity risk management program.

companyName: Airbnb, Inc.

ticker: ABNB


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms (e.g., legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing and dark web monitoring services.

companyName: Arlo Technologies, Inc.

ticker: ARLO


text: Management's Role Managing Risk We have an internal management team comprising of our Chief Financial Officer ("CFO"), Chief Legal Officer ("CLO"), VP, Corporate Controller, Sr. Director, SEC Reporting, and Director, Information Technology (the "Risk Management Team"), that plays a pivotal role in informing the Audit Committee on cybersecurity risks. The Director, Information Technology and IT team monitor cybersecurity risks and perform continual risk exercises and assessments. The Risk Management Team meets quarterly to discuss current security breaches and threats, if any, and discuss new controls and results of the cybersecurity risk monitoring, exercises, and assessments. T he Risk Management Team provides comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year.

companyName: Energy Recovery, Inc.

ticker: ERII


text: Our management team is responsible for oversight and administration of our cyber risk management protocol, and for informing relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our management team does not have prior experience administrating cybersecurity initiatives and processes, but intends to rely on threat intelligence as well as other information obtained from governmental, public or private sources and, if necessary, third-party consultants providing cyber risk services. Our Audit Committee also provides oversight of risks from cybersecurity threats, and specifically reviews and discusses our policies regarding information technology security and protection from cyber risks.

companyName: Power REIT

ticker: PW


text: o Training and Awareness: Management and the Board take reasonable steps to stay informed about cybersecurity trends, threats, and best practices through ongoing education and training. o Management reviews Company employee training programs to ensure employees are trained appropriately and updated on evolving cyber trends. o Board Training: Certain board members have received training to understand cybersecurity risks and their role in overseeing cybersecurity.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: Our executive team and Board of Directors are actively involved in overseeing cybersecurity risks. The executive team and the CIO oversee the Company's information security efforts and cybersecurity governance. This team regularly reviews our cybersecurity posture and any significant incidents that have occurred.

companyName: LIGHTPATH TECHNOLOGIES INC

ticker: LPTH


text: The Board administers its oversight role in part through its committees. The Audit Committee is responsible for overseeing and reviewing cyber and information security risks, policies and programs and reviews the Company's risk assessment, risk management and compliance policies twice a year. Senior leaders, including Matson's Chief Information Officer, review the Company's cybersecurity program with the Board at least annually, and the Chief Information Officer meets with the Audit Committee at least twice per year. Matson's information security efforts are led by its Chief Information Officer, who has over 25 years of experience in enterprise software development, infrastructure and management, including over 18 years with Matson and 7 years at Charles Schwab as Senior Manager of Middleware Security, and the Chief Information Security Officer, who is a Certified Information Systems Security Professional, Certified Information Systems Auditor, and is AWS Certified. The Chief Information Officer and the Chief Information Security Officer provide regular briefings to the Chief Executive Officer, the Chief Financial Officer, the Board, and the Audit Committee. In addition, the Corporate Compliance Committee, comprised of business unit leaders, helps oversee cybersecurity initiatives and reports twice per year to the Audit Committee. These processes are part of the risk management processes described in the risk management and strategy section above.

companyName: Matson, Inc.

ticker: MATX


text: We maintain a robust system of data protection and cybersecurity resources, technology and processes. We regularly evaluate new and emerging risks and ever-changing legal and compliance requirements. We make strategic investments to address these risks and compliance requirements to keep our data secure. We monitor risks of sensitive information and reevaluate these risks on a frequent basis. We also perform annual and ongoing cybersecurity awareness training for our employees. We have a longstanding information security risk program structured according to the National Institute of Standards and Technology Cybersecurity Framework, industry best practices, privacy legislation, and other global and local standards and regulations. This program deploys third-party cybersecurity solutions to actively manage threats to our information technology environment and includes a defense-in-depth approach with multiple layers of security controls, including network segmentation, security monitoring, endpoint protection, and identity and access management, as well as data protection best practices and data loss prevention controls, all of which are intended to preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, us.

companyName: CIVITAS RESOURCES, INC.


text: Risks from cybersecurity threats are among those that we address in the Company's general risk management program. As part of our overall risk management processes, the Company maintains various policies related to information security, including, for example, an Incident Response Policy and a Cybersecurity Incident Reporting Policy. We identify cybersecurity threats as part of our risk management processes, including (depending on the environment or systems) through internal monitoring, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environments, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments for internal and external threats, and conducting security vulnerability assessments to identify vulnerabilities. Our information technology team is responsible for identifying, assessing, and managing the Company's cybersecurity threats and risks under the oversight of our Chief Technology and Information Officer. This team works with third parties from time to time to help identify, assess, and manage cybersecurity risks, including professional services firms and other vendors.

companyName: Dutch Bros Inc.

ticker: BROS


text: Risk assessment and management Stewart has an enterprise risk management (ERM) program to assess, identify, and manage risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program to align cybersecurity efforts with Stewart's broader business goals and objectives. The cybersecurity risk is assigned to the Vice President, Information Technology (IT), who is a member of the ERM committee, for monitoring. The cybersecurity risk is also under the management oversight of Stewart's Senior Leadership Team.

companyName: STEWART INFORMATION SERVICES CORP

ticker: STC


text: The Company annually reviews its overall risk profile with the Audit Committee and full Board of Directors. Assessing, identifying and managing material risks from cybersecurity threats are integrated into the Company's overall risk management processes.

companyName: Healthcare Realty Trust Inc

ticker: HR


text: The company partners with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These assessments include penetration testing, vulnerability assessments, tabletop exercises, and reviews of incident response protocols that are designed to ensure robust protections against evolving threats.

companyName: MIDDLEBY Corp

ticker: MIDD


text: Our management team is responsible for oversight and administration of our cyber risk management protocol, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes and relies on threat intelligence as well as other information obtained from governmental, public, or private sources. Our Audit Committee also provides oversight of risks from cybersecurity threats.

companyName: REMARK HOLDINGS, INC.

ticker: MARK


text: We use information technology and third -party service providers to support our global business processes and activities, which exposes us to cybersecurity risks.

companyName: FOOT LOCKER, INC.


text: We believe that the conduct of our employees is critical to the success of our information security. We keep our employees apprised of threats, risks and the part that they play in protecting both themselves and the Company.

companyName: Anixa Biosciences Inc

ticker: ANIX


text: We maintain policies and procedures to oversee and identify cybersecurity risks associated with our third-party service providers, especially those with access to customer and employee data. Our selection and oversight of these providers incorporate cybersecurity considerations, including contractual and other mechanisms to mitigate risks. Our third-party oversight process follows published frameworks from NIST and FFIEC to account for risks throughout the entire engagement with our third-party vendors.

companyName: INDEPENDENT BANK CORP /MI/

ticker: IBCP


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Senior Director, IT & Facilities, Chief Legal Officer, Chief Financial Officer, Chief Executive Officer and others. Those individuals work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: CERUS CORP

ticker: CERS


text: The Company's information security and cybersecurity program is managed by a dedicated CIO, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The CIO provides periodic reports to our Board and Audit Committee as well as our Chief Financial Officer and other members of our senior management as appropriate. We have also established cross-functional teams to collaborate and communicate on cybersecurity-related issues. The reports to management include updates on the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the information security program, and the emerging threat landscape. Specifically, our management-driven ERM Committee and Incident Response team include executives from key departments across the Company and each work collaboratively to ensure periodic reviews and assessments of the Company's security environment are being observed.

companyName: Janus International Group, Inc.

ticker: JBI


text: We are a blank check company with no business operations. Since the date of the IPO, our sole business activity has been identifying and evaluating suitable Business Combination candidates. Therefore, we do not believe that we currently face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of any risks from cybersecurity threats. We have not encountered any cybersecurity incidents since inception.

companyName: Generation Asia I Acquisition Ltd


text: The cybersecurity program is also supported by Uber's Chief Privacy Officer and Associate General Counsel, Privacy & Cybersecurity ("CPO"), who has served in that role since August 2018. The CPO has over three decades of experience as a legal advisor to multinational corporations, including serving as Chief Privacy & Security Counsel for a Fortune 100 technology company prior to her role at Uber.

companyName: Uber Technologies, Inc

ticker: UBER


text: At least annually, the IS Program, including its effectiveness, is reviewed by the Board. Annually, all associates participate in mandatory training related to the IS Program, including information security and its importance with respect to customer and associate privacy. All associates are required to participate in monthly bank wide phishing tests. Results from these tests are delivered to our Audit Committee of the Board of Directors.

companyName: CSB Bancorp, Inc.

ticker: CSBB


text: The Audit Committee is responsible for oversight of the Company's Incident Response Plan, including evaluation of material incidents, response and other related actions, and SEC reporting obligations, which is reviewed at least annually, or as circumstances warrant.

companyName: Trinseo PLC

ticker: TSEOF


text: We deploy a sophisticated blend of layered security that protects systems and data that exist or operate within partitioned/segregated networks.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: As of December 31, 2024, we have implemented a set of comprehensive cybersecurity and data protection policies and procedures. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system. Our employees and contractors receive annual cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. We have capable employees and consultants with significant expertise in cybersecurity related to our industry. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.

companyName: MEDICINOVA INC

ticker: MNOV


text: Our CIO leads our management team in assessing and managing our response to cybersecurity threats and incidents. Our CIO has a Bachelor of Technology degree in Computer Science with over 30 years of experience in IT, with over five years managing IT Infrastructure and Security. The primary responsibility of the management team with respect to cybersecurity risk is managing our overall cybersecurity risk management program and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants, and working with all divisional, manufacturing, and functional teams on cybersecurity issues. The management team's efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents are enhanced by monthly and quarterly briefings from internal security personnel, by receipt of threat intelligence and other information obtained from governmental, public or private sources, including external consultants, periodic assessments against the NIST CSF and through alerts and reports produced by security tools deployed in our IT environment. In the event a cybersecurity incident meets certain predetermined criteria, the management team along with the Security Incident Response Team would engage the Company Board.

companyName: Utz Brands, Inc.

ticker: UTZ


text: Our Information Security team, led by our ISO, is responsible for monitoring our information systems for vulnerabilities and mitigating any issues. The Information Security team works collaboratively across the Company to understand the potential impacts of a cybersecurity incident and prioritize mitigation and other measures based on, among other things, the materiality to our business. The Information Security team has established processes designed to monitor threats in the cybersecurity landscape which include interacting with intelligence networks, working with researchers, discussions with peers at other companies, monitoring social media, reviewing government alerts and other news items and attending industry specific security conferences and trainings. The team regularly monitors our internal network and customer-facing network to identify any security issues. In addition, the Company augments the team's monitoring via the engagement of external vendors who provide continuous threat monitoring services of the Company's environment.

companyName: UNION BANKSHARES INC

ticker: UNB


text: b. Oversight of the continued and consistent implementation of our cybersecurity policies and procedures; and c. Promoting overall corporate commitment to cybersecurity.

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: Our and our Manager's cybersecurity and related controls, policies and procedures ("Cybersecurity Program") are critical business functions protecting our and our Manager's enterprise information systems, data and business operations from external and internal threats. The Cybersecurity Program prioritizes detection, analysis, response and prevention to known, anticipated or unexpected cybersecurity threats, with regular internal and third-party assessments and enterprise risk management governance reviews. The Cybersecurity Program is informed by the National Institute of Standards and Technology's ("NIST") cybersecurity framework standard, which our Manager uses to assist with our overall enterprise risk management framework, along with our compliance requirements under federal and state cybersecurity and related regulations.

companyName: PennyMac Mortgage Investment Trust

ticker: PMT


text: The Partnership's board of directors has oversight of cybersecurity risks. Our board of directors is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: MARTIN MIDSTREAM PARTNERS L.P.

ticker: MMLP


text: See Item 1A. "Risk Factors – Disruptions to, security breaches or non-compliance involving our information technology systems could harm our ability to run our business and expose us to potential liability and loss of revenues" for additional discussion of cybersecurity risks that may materially impact us.

companyName: Sprouts Farmers Market, Inc.

ticker: SFM


text: Risk Assessment. On a periodic basis, but not less than annually, the CISO, in conjunction with the Enterprise-Wide Risk Management Committee, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Corporation's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The Enterprise-Wide Risk Management Committee reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: Our CSO, who reports regularly and directly to our CEO, has primary responsibility for assessing, monitoring and managing our cybersecurity risks, including the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CSO, who joined us in 2023, has over 20 years of experience assessing and managing cybersecurity programs and cybersecurity risk at a number of different companies. Our internal security leadership team that reports to our CSO regularly communicates and meets to discuss cybersecurity threats and risk management, the effectiveness of our internal security programs, and cybersecurity emerging trends, risks, and incidents that may require increased focus. In addition, our internal audit team regularly reviews cybersecurity risks with our security team as part of our ongoing enterprise risk management program and conducts internal audits on various areas of cybersecurity risk. In addition, our CEO chairs an internal compliance committee that includes our CSO and other members of our security team and meets at least quarterly to review compliance with various laws, rules, and regulations applicable to our company, including with respect to cybersecurity matters.

companyName: Cloudflare, Inc.

ticker: NET


text: The Committee and Subcommittee each conduct both regular quarterly and as-needed meetings throughout the year during which members of the CIM Group's IT Department provide updates and report on meaningful cybersecurity risks, threats, incidents and vulnerabilities in accordance with the Committee's and the Subcommittee's respective reporting frameworks, as well as related priorities, mitigation and remediation activities, financial and employee resource levels, regulatory compliance, technology trends and third-party provider risks. To help inform this reporting framework, CIM Group maintains incident response plans and other policies and procedures designed to respond to, mitigate and remediate cybersecurity incidents based on the potential impact to CIM Group's business, IT systems, network or data, including data held by third parties, or to the IT or other critical services provided by third-party vendors and service providers.

companyName: Creative Media & Community Trust Corp

ticker: CMCT


text: The Audit Committee receives quarterly reports from our management-led Enterprise Risk Management Committee on our cybersecurity risks and mitigation initiatives. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Offerpad Solutions Inc.

ticker: OPAD


text: Our CISO and Chief Legal Officer oversee all cybersecurity efforts and lead our IRM organization. Our CISO has over two decades of experience in the cybersecurity and information security fields, including experience with both private businesses and the military. In addition, he has degrees in both information technology and business administration. Our IRM professionals include multiple personnel with more than ten years of experience and expertise in information security and are continually building their professional knowledge through local information systems communities and an available set of educational materials.

companyName: TRINITY INDUSTRIES INC

ticker: TRN


text: As one of the critical elements of the Company's overall risk management, our Adviser's cybersecurity program is focused on the following key areas:

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: Our business therefore depends on the continuous, effective, reliable, and secure operation of our computer hardware, software, networks, Internet servers, and related infrastructure. To the extent that our hardware or software malfunctions or access to our data by internal personnel, suppliers or customers through the Internet is interrupted or compromised, our business could suffer.

companyName: Beyond Air, Inc.

ticker: XAIR


text: Our Cybersecurity Council, comprised of cross-functional senior leaders from operations, finance, internal audit, product management, and information technology teams, also reviews and assesses security risks and issues from a business and technology perspective across all organizations within Watts on a quarterly basis, with the guidance and input of the CIO and VP of Information Security. Our executive management team is primarily responsible for assessing and managing our material or reasonably likely to be material risks from cybersecurity threats with the advice and input of the CIO and VP of Information Security, including based on the above and from external advisors as necessary.

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we conduct security assessments of all third-party providers before engagement to ensure compliance with industry cybersecurity standards and frameworks. This includes assessments performed by our Senior Director of IT, who oversees the Company's cybersecurity function.

companyName: SAB Biotherapeutics, Inc.

ticker: SABS


text: We assess, identify and manage cybersecurity risks through various processes within our Enterprise Risk Management Program and Information Security Program. We focus on all areas of cybersecurity, including threat and vulnerability management, security monitoring, identity and access management, phishing awareness, risk oversight, third-party risk management, disaster recovery and continuity management. We have established policies, including those related to privacy, information security and cybersecurity, and we employ a broad and diversified set of cybersecurity risk monitoring and risk mitigation techniques. Internal audits, external audits and self-assessments are conducted to assess the effectiveness and maturity of our Enterprise Risk Management Program and Information Security Program.

companyName: Fidelity National Financial, Inc.

ticker: FNF


text: To our knowledge, we have not been subject to cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, the Company, its operations or financial standing.

companyName: LGI Homes, Inc.

ticker: LGIH


text: In 2017, we experienced a material cybersecurity incident following a criminal attack on our systems that involved the theft of personal information of U.S., Canadian and U.K. consumers. If we experience additional significant compromises of our security measures, including from incidents that we fail to detect for a period of time, sensitive data may be accessed, stolen, disclosed, altered or lost. Any such access, disclosure, alteration or other loss of information could subject us to significant litigation, regulatory fines or penalties, any of which could have a material adverse effect on our cash flows, competitive position, financial condition or results of operations.

companyName: EQUIFAX INC

ticker: EFX


text: Our company has implemented robust processes to assess, identify, and manage material cybersecurity risks effectively. These processes are an integral component of our overall risk management system, ensuring that cybersecurity concerns are comprehensively addressed within our broader risk management framework. Risk assessment, identification, and management processes are seamlessly integrated into our overall risk management system. The processes for assessing, identifying, and managing cybersecurity risks are aligned with our strategic objectives and business goals. We foster cross-functional collaboration and communication to facilitate the integration of cybersecurity risk management into various business functions and processes.

companyName: ESTABLISHMENT LABS HOLDINGS INC.

ticker: ESTA


text: The Bank's Board of Directors is charged with overseeing the establishment and execution of the Bank's security management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility the Board has delegated primary oversight responsibility over the Bank's security management framework, including oversight of cybersecurity risk and cybersecurity risk management, to the Information Technology /Information Security Committee of the Board of Directors. The Information Technology /Information Security Committee receives regular updates on cybersecurity risks and incidents and the cybersecurity program through direct interaction with the Chief Information Technology Officer and provides periodic updates regarding cybersecurity risks and the cybersecurity program to the full Board of Directors. Additionally, awareness and training on cybersecurity topics is provided to the Board on an annual basis.

companyName: BCB BANCORP INC

ticker: BCBP


text: The company's dedicated cyber risk organization meets regularly with business units to raise cyber risk awareness and keep diverse cybersecurity skill sets connected across the enterprise. Chevron has invested in broad cybersecurity awareness and required training to educate those with access to Chevron's networks on company policy and best practices. The company conducts regular phishing tests to train and assess its workforce's ability to identify malicious emails.

companyName: CHEVRON CORP

ticker: CVX


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our information security organization is comprised of internal and external security and technology professionals. We continue to make investments in information security resources to mature, expand, and adapt our capabilities to address emerging cybersecurity risks and threats. In addition, we have a multifunctional cybersecurity committee comprised of information technology, operations, risk, and finance members who will meet quarterly to assess new vulnerabilities and threats, update risk assessments and assess the implementation of the Company's cybersecurity risk management program. This committee will report periodically to the management team on matters involving cybersecurity risks and incidents.

companyName: TERAWULF INC.

ticker: WULF


text: Continuous Vulnerability Management: We continuously monitor our IT networks and legacy systems to identify threats that may adversely affect critical systems and information, ensuring that our broader IT environment remains secure.

companyName: LIGHTPATH TECHNOLOGIES INC

ticker: LPTH


text: We use service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. We have a vendor management program designed to manage cybersecurity risks associated with our use of certain of these providers. The program includes a risk assessment for certain vendors that host our Information Systems and Data. For vendors who host our critical data, we have processes designed to assess the vendor's ability to support business continuity and disaster recovery. Where appropriate, we conduct security questionnaires and a review of vendors' security. This review may include reviewing program documentation, security reports and audits, conducting security assessment calls with the vendor's security personnel, and imposing information security-related contractual obligations on the vendor. We also request data privacy assessments from certain vendors as appropriate. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.

companyName: Bolt Biotherapeutics, Inc.

ticker: BOLT


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee. Our executive management team inform the Audit Committee on cybersecurity risks on a regular basis, with a minimum frequency of once per year.

companyName: Ainos, Inc.

ticker: AIMD


text: We have not been materially impacted by risks from cybersecurity threats and as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, there can be no assurance that Teva will not be materially affected by such risks in the future. Our systems and networks have been, and are expected to continue to be, the target of increasingly advanced and evolving cyber-attacks and cybersecurity incidents in the future may adversely impact our business, financial condition and results of operations, and we are continuing to actively monitor such threats. For more information, see "Item 1A, Risk Factors—Risks related to our general business and operations—Significant disruptions of our information technology systems could adversely affect our business" and "Item 1A, Risk Factors—Risks related to our general business and operations—A data security breach could adversely affect our business and reputation."

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA


text: of Directors has oversight of our enterprise risk assessment and risk management processes, as well as the steps taken to mitigate these risks, including for cybersecurity matters. The Audit Committee of our Board of Directors has oversight of cybersecurity risk assessment and risk management policies as part of its risk management oversight responsibilities. Any significant cybersecurity matters, including those related to incidents, are escalated to the Board of Directors.

companyName: Dalrada Technology Group, Inc.

ticker: DHTI


text: In light of the pervasive and increasing threat from cyberattacks, the Board and the Audit Committee, with input from management, assess the Company's cybersecurity threats and the measures implemented by the Company in an effort to mitigate and prevent cyberattacks. The Audit Committee consults with management regarding ongoing cybersecurity initiatives, and requests that management to report to the Audit Committee or the full Board regularly on their assessment of the Company's cybersecurity program and risks. Both the Audit Committee (on no less than a quarterly basis) and the full Board (on no less than an annual basis) receive regular reports from our Chief Information Officer ("CIO") on cybersecurity risks, timely reports regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Janus International Group, Inc.

ticker: JBI


text: The Company's cybersecurity program is led by the CISO who is responsible for assessing and managing the Company's information security and technology risks, including cybersecurity. On December 15, 2023, the CISO announced his retirement from the Company, and since that time, our Chief Digital and Operations Officer is serving as our acting CISO, executing all of the responsibilities of the CISO, while the Company conducts a search to fill the position. The Company's Chief Digital and Operations Officer has extensive experience in leading information systems management, strategy and operational execution, including information security and incident management, prevention and response.

companyName: HARLEY-DAVIDSON, INC.

ticker: HOG


text: Our advisor's Vice President - Communications leads our advisor's information security group responsible for overseeing our information security program. Our advisor's Vice President - Communications has over 18 years of industry experience.

companyName: Moody National REIT II, Inc.


text: The Company's board of directors oversees, among other things, the adequacy and effectiveness of the Company's ability to assess, identify, and manage material risks from cybersecurity threats. Management has been informed as to the need to be constantly aware of the possibility of cybersecurity breaches and to inform the board of directors immediately upon receipt of any information with respect to an actual or even a potential breach. In such event, evaluation of the degree of the breach will be made and third-party experts consulted and/or retained, as necessary, to address any such situation. As a technology-based company, management believes that the security it currently has in place to protect its proprietary information, and that the personal information of its employees and customers, is sufficient and appropriate for its current level of business activities.

companyName: WORLDS INC

ticker: WDDD


text: The Board's oversight of cybersecurity risk is supported by our CISO. The CISO and CIO attend ITC and ERMC meetings and provide cybersecurity updates to these Board committees. The CISO also provides annual risk assessments and reports regarding the information security program summary report to the full Board of Directors. Our CRO, in conjunction with our CISO and CIO, facilitates the involvement of the ITC in oversight of potentially significant cybersecurity incidents.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: While we are regularly exposed to malicious technology-related events and threats, none of these, either individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this Annual Report on Form 10-K. In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services and loss of investor confidence.

companyName: CorMedix Inc.

ticker: CRMD


text: We also have a mature incident response process in place in the event a cybersecurity incident occurs. This process defines roles, responsibilities and action plans designed to contain, eradicate, and restore systems in the event of a major disruption. Regularly, we conduct tabletop exercises to simulate responses to an incident and implement any insight gained from those exercises to improve our recovery practices. As part of these processes, we regularly engage with assessors, consultants, auditors, and other third parties to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.

companyName: UNIVERSAL HEALTH SERVICES INC

ticker: UHS


text: Our information security processes are designed to assess, identify and manage material risks from cybersecurity threats. In conducting our business activities, we are entrusted with confidential information from our clients, business partners and employees. Confidential information may include sensitive business and technical information, as well as personal information. Our Information Security Management System ("ISMS"), based on ISO/IEC 27001, is an integral part of our overall enterprise risk management system, and serves as a framework for handling cybersecurity threats and incidents, including such threats and incidents associated with our use of services by information technology suppliers. The ISMS is operated by our Global Information Security team headed by our Global Chief Information Security Officer ("CISO"). We maintain physical, electronic and procedural safeguards designed to guard confidential information contained within our information systems from loss, misuse, unauthorized access, disclosure, alteration or destruction. We have layered defenses designed to protect against intrusions that could affect the confidentiality, integrity and availability of information.

companyName: SS&C Technologies Holdings Inc

ticker: SSNC


text: Our board of directors has ultimate oversight of our strategic and business risk management and, as such, has oversight responsibilities for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing and updating processes to ensure such potential risks are monitored, putting in place appropriate mitigation measures, and providing regular reports on cybersecurity trends and risks, and should they arise, any material incidents with our board of directors.

companyName: Riot Platforms, Inc.

ticker: RIOT


text: Our security policies and processes are based on industry best practices and are revisited regularly to ensure their appropriateness based on risk, threats and current technological capabilities. We regularly assess our threat landscape and monitor our systems and other technical security controls, maintain information security policies and procedures, including a breach response plan, ensure maintenance of backup and protective systems, and engage with a Managed Service Provider who has a team of security personnel managing our efforts and initiatives. We review System and Organization Controls 1 (SOC 1 Type II) certifications where relevant from key third party partners and other service providers with access to information assets at least annually.

companyName: KIORA PHARMACEUTICALS INC

ticker: KPRX


text: Our data is dynamically backed up to mitigate against data loss. To prevent unauthorized access and data breaches, we encrypt sensitive data both in transit and at rest. We have also implemented access controls and multi-factor authentication to ensure that only authorized personnel can access sensitive information. We also utilize third-party information technology systems vendors to conduct regular network and endpoint monitoring.

companyName: Investview, Inc.

ticker: INVU


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our Company's Information Security Program encompasses the guiding policies over our cybersecurity risk management. Additionally, our IT team uses industry-leading tools to help protect stakeholders against cybercriminals. We leverage the latest encryption practices and cyber technologies on our systems, devices, and third-party connections and further review vendor encryption to ensure proper information security safeguards are maintained. Our Company team members are responsible for complying with our cybersecurity standards and complete training to understand the behaviors and technical requirements necessary to keep information secure.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: Threat Management Process. In addition to the regular and routine vulnerability scanning, FNB relies on various threat intelligence feeds for the identification and awareness of potential threats that could impact the FNB environment. Using third party vendors to assist, threats are integrated into our monitoring solutions, email filtering, web-browsing controls, malware detection, and perimeter firewalls to proactively prevent, detect and deter threats with the capability to impact the FNB environment.

companyName: FNB CORP/PA/

ticker: FNB


text: Risks from cybersecurity threats have, to date, no t materially affected us, our business strategy, results of operations or financial condition.

companyName: One World Products, Inc.

ticker: OWPC


text: We do not believe we have experienced any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial conditions, including in Fiscal 2024. However, cyber threats continue to evolve, and there can be no assurance that the actions and controls we have implemented and are implementing will be sufficient to protect our systems, information, or other property. While we maintain cybersecurity insurance to protect against potential losses arising from security incidents, the costs related to threats or disruption may not be fully insured.

companyName: WINNEBAGO INDUSTRIES INC

ticker: WGO


text: The Audit Committee is informed of material risks, if any, from cybersecurity threats pursuant to escalation criteria set forth in the Company's disclosure controls and procedures. Further, at least once per quarter, a member of the Company's Audit Committee reports material risks, if any, from cybersecurity threats to the Company's board of directors. The Company's management team also assesses and manages material risks, if any, from cybersecurity threats.

companyName: Sow Good Inc.

ticker: SOWG


text: Impact of Cybersecurity Threats As previously disclosed, we have experienced significant cyber incidents in the past, including in April 2023, that have impacted our operations and financial results. The related expense is reflected in "Acquisition, cyber incident, and other, net" on the Consolidated Statement of Operations for the year ended December 31, 2023, and the reserve balance is included in "Accounts payable and accrued expenses" in our Consolidated Balance Sheets as of December 31, 2023. For additional information regarding such risks and the affects thereof on our business strategy, operations and financial condition, see Part I, Item 1A, Risk Factors – "A failure of our information technology systems, cybersecurity attacks or a breach of our information security systems, networks or processes could cause business disruptions and the loss of confidential information and may materially adversely affect our business."

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: We are not aware of any risks from cybersecurity threats that have materially affected our business strategy, results of operations or financial condition or are reasonably likely to have a material effect. However, cyber-attacks are increasing in frequency, sophistication and intensity, and despite our ongoing efforts we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. Please refer to "Risk Factors" in Part I, Item 1A of this Form 10-K for more information on the risks posed to us by cybersecurity threats.

companyName: ALPHA & OMEGA SEMICONDUCTOR Ltd

ticker: AOSL


text: Our Vice President of Information Technology and Facilities and our Head of Cybersecurity lead the operational oversight of company-wide cybersecurity strategy, policy, standards and processes, and work across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The Vice President of Information Technology and Facilities has over 16 years of experience delivering systems across all functions of life science organizations, including support of infrastructure, security, software as a service (SaaS) systems and data integrations, along with ten years working with cybersecurity. The Head of Cybersecurity has approximately 15 years of cybersecurity expertise and has received Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP) certifications.

companyName: Immunovant, Inc.

ticker: IMVT


text: A discussion of how Abbott's business, results of operations, and financial condition could be materially adversely affected by risks from cybersecurity threats is contained in Item 1A. Risk Factors under "Abbott depends on sophisticated information systems and maintains protected personal data, and a significant cybersecurity incident or other disruption affecting these information systems or protected personal data could have a material adverse effect on Abbott's business, financial condition and results of operations."

companyName: ABBOTT LABORATORIES

ticker: ABT


text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the Company has adopted and maintains written policies and procedures for the protection of Company's information systems and nonpublic information stored on those systems, which are based on the Company's risk assessment and that address all other specific topics as may be required by applicable laws and regulations.

companyName: CREDIT ACCEPTANCE CORP

ticker: CACC


text: Our information technology ("IT") controls are subject to audit by internal and external auditors, as well as the ABS. The management team at least annually advises the Corporate Governance and Risk Assessment Committee of the Board on information security matters and provides user training and monitoring of system access as part of our compliance program. Our team of IT professionals, led by the Director of IT, collectively has over 50 years of experience in the cybersecurity space and have professional security certifications and advanced training in the field of cybersecurity and technology. The IT team has primary responsibility for OSG's overall cybersecurity risk management program and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, and alerts and reports produced by security tools.

companyName: OVERSEAS SHIPHOLDING GROUP INC


text: We have established processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized attempts to access our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems.

companyName: Verde Clean Fuels, Inc.

ticker: VGAS


text: BancShares maintains processes for reporting and escalation from each line of defense through management to senior leadership, to management-level committees, and to committees of the Board and the Board, as appropriate. Reporting includes top and emerging risks, and other operational risk metrics.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: The Bancorp's CISO is responsible for information security policies and the coordination of information security efforts across the organization. The CISO has over 35 years of diverse experience in information technology management and cybersecurity leadership at Fifth Third and at other large, complex organizations. This prior experience includes leadership of functions for cybersecurity threat management, intelligence, risk mitigation and incident response. The CISO has a Bachelor of Science degree in Computer and Information Science and is a certified Six Sigma Black Belt. The Bancorp's CISO reports to the Chief Technology & Information Security Officer. The CISO also reports directly to the Technology Committee and participates in various management councils and committees. The Bancorp's IT CSRM team monitors that the CISO has appropriate authority to carry out the duties and responsibilities necessary of that position.

companyName: FIFTH THIRD BANCORP

ticker: FITB


text: Our approach to cybersecurity risk management includes the following key elements: • Multi-Layered Defense and Continuous Monitoring – We work to protect our computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks. We utilize data analytics to detect anomalies and search for cyber threats. Our Cybersecurity Operations Center provides comprehensive cyber threat detection and response capabilities and maintains a 24x7 monitoring system which complements the technology, processes and threat detection techniques we use to monitor, manage and mitigate cybersecurity threats or vulnerabilities. From time to time, we engage third-party consultants or other advisors to assist in assessing, identifying and/or managing cybersecurity threats. We also periodically use our Internal Audit function to conduct additional reviews and assessments. • Insider Threats – We maintain an insider threat program, led by our Vice President, Corporate and Enterprise Security, designed to identify, assess, and address potential risks from within our company. Our program evaluates potential risks consistent with industry practices, customer requirements and applicable law, including privacy and other considerations. • Information Sharing and Collaboration – We work with government, customer, industry and/or supplier partners, such as the National Defense Information Sharing and Analysis Center and other government-industry partnerships, to gather and develop best practices and share information to address cyber threats. These relationships enable the rapid sharing of threat and vulnerability mitigation information across the defense industrial base and supply chain. • Third Party Risk Management – We conduct cybersecurity assessments before sharing or allowing the hosting or processing of sensitive data in computing environments managed by third parties, and our standard terms and conditions contain contractual provisions requiring certain cybersecurity and data protections and controls. Finally, we require these third parties to notify us promptly of cyber incidents or data breaches so that we can assess potential impact on us. • Training and Awareness – We provide annual cybersecurity and information security awareness training to our employees with network access to help identify, avoid and mitigate cybersecurity threats and insider risks. This training also includes awareness about the policies and guidance associated with data privacy and protection of personal information, and protection and security of our company, customer and other third-party data. Our employees with network access also participate in annual spear phishing exercises. We also periodically host cybersecurity and ransomware tabletop exercises with management and other company functional stakeholders to practice rapid cyber incident response. • Supplier Engagement – We provide training and other resources to our suppliers to support cybersecurity resiliency and data security principles in our supply chain. We also require our suppliers, subcontractors and third-party service providers to comply with our standard cybersecurity-related terms and conditions, in addition to any requirements from our customers, as a condition of doing business with us, and require them to complete information security questionnaires to review and assess any potential cyber-related risks depending on the nature of the services or products being provided.

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: The Company provides cybersecurity services to the Bank. In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. Cybersecurity risk management is overseen both as a critical component of our overall risk management program and as a standalone program. As further described below, we have implemented a risk-based, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We also offset cyber risk through internal training and testing of our employees, among other processes, in accordance with our policies and procedures.

companyName: FIRST INTERSTATE BANCSYSTEM INC

ticker: FIBK


text: Our Information Security Policy and Information Security Program are the standards used to protect the Bank's confidential information. The Information Security Policy is annually reviewed, updated, and approved by the Risk Committee and the Board of Directors.

companyName: WSFS FINANCIAL CORP

ticker: WSFS


text: Cybersecurity risks are identified and prioritized for resource allocation using two annual risk assessments: an internal risk assessment utilizing the Federal Financial Institutions Examination Council's ("FFIEC") Cybersecurity Assessment Tool, and a formal risk assessment prepared in conjunction with an external consultant.

companyName: NATIONAL BANKSHARES INC

ticker: NKSH


text: Third-parties on Risk Management the complexity and evolving nature of cybersecurity threats, we plan to engage external experts, including consultants and auditors, in evaluating and testing our risk management systems. These services will enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties is expected to include annual audits, ongoing threat assessments, and regular consultations on security enhancements.

companyName: CleanCore Solutions, Inc.

ticker: ZONE


text: As noted above, the Board has delegated oversight responsibility at the management level for risk-related matters to the Enterprise Risk Committee, members of which include senior leaders throughout the company. The Enterprise Risk Committee has delegated primary responsibility for management-level oversight of cybersecurity risk management to the Technology Risk Committee. The Technology Risk Committee receives reports on cybersecurity risk matters on a regular basis from the company's Chief Security Officer. The Technology Risk Committee reviews and approves the company's management-level cybersecurity risk policies and standards. The Technology Risk Committee also reviews and monitors metrics relating to cybersecurity risk. The Technology Risk Committee escalates matters to the Enterprise Risk Committee as appropriate.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. We also have not been subject to any penalties or settlements.

companyName: PALVELLA THERAPEUTICS, INC.

ticker: PVLA


text: Our full Board oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. The Board receives regular presentations and reports from management who are responsible for managing and assessing cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Board also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: HUDSON TECHNOLOGIES INC /NY

ticker: HDSN


text: We have an enterprise-wide information security program designed to identify, protect against, detect, respond to and recover from cybersecurity risks, threats and events. Our cyber risk management system contributes significantly to the overall resilience and integrity of our business by, among other things, integrating the risk identification process in all major company initiatives and deployment processes, implementing a unified approach to managing both digital and traditional business risks, making continuous improvements and regularly reporting to management and EchoStar's Board of Directors as a whole to ensure accountability.

companyName: DISH DBS CORP


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, operational and financial risk areas. Our cybersecurity risk management program includes: (i) risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise information technology environment; (ii) full-time internal subject matter experts and a service desk with extensive security knowledge and skill responsible for managing our cybersecurity risk assessment processes, our security controls and our response to cybersecurity incidents; (iii) the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; (iv) cybersecurity awareness training of our employees; and (v) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Singular Genomics Systems, Inc.


text: We have developed a robust cyber incident response plan which provides a documented framework for handling high severity security incidents and facilitates coordination across a cross-disciplinary team of employees, legal counsel and third party service providers. Our information security team, which is part of our IT department, constantly monitors threat intelligence feeds, handles vulnerability management, responds to incidents and reports to the Information Security Coordinator. Upon detection of an event that meets certain assessment thresholds, the Information Security Coordinator reports such matters to the Incident Response Team, who then review the event and report to senior management, the cyber committee or our Board as appropriate. Cybersecurity events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.

companyName: Riley Exploration Permian, Inc.

ticker: REPX


text: We have integrated cybersecurity risk assessments into Bunge's overall enterprise risk management framework to promote a company-wide culture of cybersecurity risk management. Our CRO formulates periodic reports and provides them to our Management Risk Committee ("MRC"). As noted in "Item 1. Business - Risk Management", the MRC reviews key enterprise risks on an ongoing basis and is responsible for reviewing and monitoring key exposures, emerging risks, and drivers of risk.

companyName: Bunge Global SA

ticker: BG


text: The Company's cybersecurity program is focused on the following key areas • Technical Safeguards The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning The Company has established and maintains incident response and recovery plans to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards, and such plans are tested and evaluated on a regular basis. • Dedicated Staffing The Company maintains a Network Operations Center staffed with dedicated IT security, infrastructure, and compliance professionals who oversee risk assessments, security processes, and incident responses. • Third-Party Risk Management The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems. • Outside Consultants The Company engages various outside consultants, including contractors, assessors, outside attorneys and other third parties, to among other things Assist in the design, implementation, and testing of our cybersecurity program, policies and procedures monitor Company networks, servers and endpoints to identify vulnerabilities perform assessments on the Company's cybersecurity measures, including independent reviews of the Company's information security control environment and operating effectiveness review and place cyber insurance coverages including access to various third-party vendors to support the Company, should the need arise assist the Company in ensuring ongoing compliance with applicable legal and regulatory requirements. • Education and Awareness The Company provides ongoing and annual training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: TIC Solutions, Inc.

ticker: TIC


text: We believe our cybersecurity risk management practices are an important part of our enterprise risk management processes, which must be continuously updated and improved. As of the date of this Annual Report, we have not identified risks from cybersecurity threats, including as a result of any past cybersecurity incidents, since the beginning of the last full fiscal year that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. See the caption titled "Risks Relating to Technology, Cybersecurity and Data Privacy" in Part I, Item 1A "Risk Factors" in this Annual Report for more information about cybersecurity and data privacy risks.

companyName: Wheels Up Experience Inc.

ticker: UP


text: Related to Cybersecurity Risks Our board of directors holds overall oversight responsibility for the Company's strategy and risk management processes, including in relation to cybersecurity risks. Our board exercises its oversight function through the audit committee, which oversees the assessment and management of risk exposure across various areas, including cybersecurity. Our audit committee receives regular reports from our Chief Financial Officer on significant cybersecurity matters, including, where appropriate, whether any significant incidents have occurred.

companyName: Markforged Holding Corp


text: Our audit committee has oversight over cybersecurity risks. Our management provides periodic presentations to the audit committee on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable. The audit committee provides updates regarding our cybersecurity program to the board of directors when material.

companyName: Eightco Holdings Inc.

ticker: ORBS


text: Effective risk management is critical to Anywhere's ability to achieve its strategy. The Board oversees management in exercising its responsibility for managing risk, considering our framework of policies, procedures, and processes to anticipate, identify, assess, prioritize, and mitigate risks across the Company.

companyName: Anywhere Real Estate Group LLC


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our IT and Legal and Compliance departments work with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Y-mAbs Therapeutics, Inc.


text: The Board of Directors, which is comprised of independent directors, oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. They receive reports regarding such risks from management, including our Senior Vice President of Corporate Quality and IT. They also oversee the response to any significant cybersecurity incidents. Our Senior Vice President of Corporate Quality and IT, who has extensive cybersecurity knowledge and skills gained from over 20 years of work experience, heads the team responsible for implementing and maintaining cybersecurity and data protection practices at Globus and reports directly to the Chief Operating Officer.

companyName: GLOBUS MEDICAL INC

ticker: GMED


text: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are maintained, tested and evaluated on a regular basis.

companyName: LKQ CORP

ticker: LKQ


text: Management is promptly updated regarding any significant security events and the Cybersecurity Committee regularly reviews updates from our CISO, information security and product security leaders about cyber threat response preparedness, security controls and procedures, security program maturity milestones, risk and approaches to risk mitigation and the current and emerging threat landscape. In addition, all members of our board of directors receive management's cybersecurity updates to the Cybersecurity Committee as part of their regular attendance at meetings of our board of directors.

companyName: Fortinet, Inc.

ticker: FTNT


text: Our approach to cybersecurity risk management includes the following: • Multi-Layered Defense and Monitoring – We work to protect our computing environments from cybersecurity threats through multi-layered defenses and monitoring efforts to identify cybersecurity threats, and to help prevent future attacks. We utilize data analytics systems to detect anomalies and identify cyber threats. From time to time, we engage third-party consultants or other advisors to assist in assessing, identifying, and/or managing cybersecurity threats. We also periodically use our internal audit partner to conduct additional reviews and assessments. • Insider Threats – We maintain organizational controls such as limited access, and access removal for terminated employees, designed to minimize insider threats, and address potential risks from within our Company. Our measures and controls are informed by industry practices, and designed to be consistent with applicable law, including privacy and other considerations. • Third Party Risk Assessments – We conduct privacy and information security risk assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties. • Training and Awareness – We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees with network access are required to participate annually in training, including phishing simulations and other awareness training. We also periodically host tabletop exercises with management and other employees to practice rapid cyber incident response. • Supplier Engagement – Our standard terms and conditions contain contractual provisions requiring that our third-party suppliers disclose to us the technical and organizational measures they maintain, the standards and certifications by which they are evaluated for information and cyber security, and their cybersecurity insurance protection level. We seek to mitigate risk by evaluating the foregoing against any potential cyber-related risks depending on the nature of the services being provided.

companyName: Zevia PBC

ticker: ZVIA


text: Our Executive Vice President of Global Operations and our Director of Information Security are responsible for ongoing assessment and supervision of cybersecurity risks, supported by a dedicated Information Security team who reports up to those individuals. Our Director of Information Security has primary oversight of material risks from cybersecurity threats, has over 25 years of experience in cybersecurity-related roles and holds industry-recognized certifications. Our Executive Vice President of Global Operations and Director of Information Security review and evaluate our cybersecurity readiness through internal cybersecurity measures and metrics, as well as third-party penetration tests and control assessments against industry standards. We also employ various defensive and continuous monitoring techniques designed to escalate potential issues in a timely manner to our Director of Information Security.

companyName: CIRRUS LOGIC, INC.

ticker: CRUS


text: The Board oversees management's implementation of our cybersecurity risk management program and receives updates on the cybersecurity risk management program from management at least annually. In addition, management updates the Board regarding any material or significant cybersecurity incidents, as well as incidents with lesser impact potential as necessary.

companyName: NEXGEL, INC.

ticker: NXGL


text: nCino's CISO reports cyber security risk assessment results at Disclosure Committee Meetings, Board and Audit Committee Meetings, and executive subcommittees specializing in cyber security risk management (Risk Information Security Committee). nCino maintains a documented process for when and by whom senior management is informed of a cybersecurity incident and when such information will be reported to affected parties. These processes are detailed within our Incident Response Plan which is regularly reviewed and updated by the information security team.

companyName: nCino, Inc.

ticker: NCNO


text: We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. Accordingly, we address these risks by implementing and maintaining processes, and technologies designed to prevent, detect, and mitigate incidents that could pose cybersecurity risk. We are equally subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including: intellectual property theft; fraud; extortion; harm to employees or customers; interruption of business activities and activities of our customers; violation of privacy laws; litigation and legal risk; and reputational risk. In adopting our risk assessment and management program, we are committed to safeguarding our systems and data.

companyName: Mawson Infrastructure Group Inc.

ticker: MIGI


text: The assessment and management of material risks from cyber threats is managed by the CIDO, CISO and Cybersecurity Council, as further described below.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: As part of our framework, we maintain certain processes defined to assess, identify and manage risks. For example, we have an incident management and response process under which we communicate the details of certain threats and incidents to management and the audit committee of the board of directors as may be appropriate; use manual and automated processes that are designed to monitor relevant information systems for vulnerabilities, threats and incidents; manage and take certain actions designed to address incidents that may occur; and take actions designed to remediate certain vulnerabilities identified in relevant environments. We employ an array of data security technologies, processes, and methods across our infrastructure designed to protect our systems and sensitive information from unauthorized access. We work with information technology consultants who provide advice and expertise on monitoring evolving industry practices. Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, certain management executives, including our Senior Director of Information Technology and Chief Financial Officer evaluate material risks from cybersecurity threats in connection with our overall business objectives and reports such evaluations to the audit committee of the board of directors as appropriate, which then evaluates our overall enterprise risks. In addition to the third parties above, we use additional third-party service providers to perform a variety of functions throughout our business, such as enterprise and employee management platforms, labs, contract research organizations, contract manufacturing organizations, and supply chain resources. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, we take steps designed to address cybersecurity risks that such service providers may present to us, such as conducting diligence into such service providers' cybersecurity practices and risk profiles.

companyName: BioAge Labs, Inc.

ticker: BIOA


text: Our CISO provides briefings to the Audit and Risk Committee along with our CEO and other members of our senior management team, both on a quarterly basis via the Qualys Security Steering Committee and as needed, regarding our cybersecurity risks and activities, including, if any, critical and high impact cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the emerging threat landscape. Our Audit and Risk Committee provides regular updates to the board of directors on such reports. In addition, our CISO and management team provide periodic briefings to the board of directors on cybersecurity risks and activities. Management is committed to notifying the Audit and Risk Committee, and the full Board in the event of a cyber incident that is confirmed to have a material effect on Qualys, or in the event that Qualys has identified a cyber risk that is likely to have a high probability of having a material impact on Qualys if not mitigated.

companyName: QUALYS, INC.

ticker: QLYS


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; cybersecurity awareness training of our employees, incident response personnel and senior management;

companyName: Plymouth Industrial REIT, Inc.


text: Incident History: As of March 31, 2025, we have not encountered any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition. Nevertheless, we acknowledge that completely eliminating risk is challenging, and undetected incidents may still occur.

companyName: Securetech Innovations, Inc.

ticker: SCTH


text: The Company has integrated the assessment, identification, and management of cybersecurity threats within its overall risk assessment process. In general, cybersecurity risk is overseen by management which reports and discusses cyber risks and developments, if any, with the Board of Directors. In addition, the Company has engaged an outside managed IT services company which provides continuous monitoring of any events that could cause a business interruption or degradation of technology performance as well as any information regarding security incidents that may pose a risk to the Company.

companyName: Lightning Gaming, Inc.


text: Our Board of Directors has adopted a written statement, known as the Independent Board Candidate Qualifications and made available on our website, outlining the qualities sought in our directors. This statement, which is refreshed periodically and was most recently updated in January 2023, is used by the Nominating, Governance and Corporate Responsibility Committee ("NGCR Committee") in evaluating individual director candidates. The NGCR Committee has identified experience with overseeing and managing risk management processes, including with respect to cybersecurity, as being important to creating an effective, well-rounded and diverse Board. Directors with experience overseeing and managing risk management processes play a critical role in the Board's oversight of our enterprise risk management process.

companyName: COLGATE PALMOLIVE CO

ticker: CL


text: Notwithstanding the extensive approach TEGNA takes to cybersecurity, we face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have from time to time experienced threats to our information systems and data. For more information about the cybersecurity risks we face, see the risk factor entitled "Our efforts to minimize the likelihood and impact of adverse cybersecurity incidents and to protect our technology and confidential information may not be successful and our business could be negatively affected" in Item 1A. "Risk Factors".

companyName: TEGNA INC

ticker: TGNA


text: Notwithstanding our program, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For further information, refer to Section 1A, Risk Factors for a discussion of risks related to cybersecurity and technology.

companyName: BRUNSWICK CORP

ticker: BC


text: If a cybersecurity incident occurs, under the IRP, the information security coordinator or a designee is required to notify, as necessary and applicable, the IRT and senior executives and organizational leadership, including our Chief Legal Officer, our business partners or service providers and other authorities. Our Chief Legal Officer, working with senior executives, is required under the IRP, as appropriate, to notify the Audit Committee of any cybersecurity incident. As discussed below, the Audit Committee of our Board of Directors oversees risk management relating to cybersecurity.

companyName: HELEN OF TROY LTD

ticker: HELE


text: From time to time, we experience security incidents. As of the date of this report, no cybersecurity incidents have had a material adverse effect on our business, financial condition or results of operations. Notwithstanding our ongoing investments in our cybersecurity program, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cyber risk insurance, the costs relating to certain kinds of security incidents could be substantial, and our insurance may not be sufficient to cover losses related to any future incidents involving our data or systems.

companyName: NEW YORK TIMES CO

ticker: NYT


text: Our third-party advisor has performed cybersecurity risk assessments of our information technology security processes and implemented technologies to lessen risk. Using third party services, we monitor, scan, assess, audit, and remediate identified vulnerabilities across our networks, as appropriate. Furthermore, recognizing that our employees are an essential line of defense in cybersecurity, we require employees to participate in training and testing programs through which we provide education on the risk of potential cybersecurity incidents, methods for identification of such incidents and appropriate responses. Our policies and processes are informed by industry standard practices regarding application security, access management, device protection, network management, and data loss prevention and recovery.

companyName: CRAWFORD UNITED Corp


text: Our cybersecurity risk management program includes processes that incorporate and utilize certain principles from the National Institute of Standards and Technology Cybersecurity Framework and the Center for Internet Security – Top 18 Critical Security Controls – Control Level Framework. The program aims to protect and preserve the security, availability, integrity, confidentiality, and privacy of our information systems and information residing on those systems and includes controls and procedures for the prevention, identification, containment, and remediation of cybersecurity threats through the use of various technologies, tools, policies, standards, and practices. Features of our cybersecurity risk management program include: • An expectation, set forth in our Code of Ethics, that all employees are responsible for protecting our data, operations and environment from unauthorized access and use; • Regular cybersecurity risk assessments and benchmarking; • Policies and processes related to the detection and reporting of and response to cybersecurity events; • Cybersecurity training for all newly hired employees upon onboarding; • Individualized, biannual employee information security assessments, coupled with tailored follow-on employee trainings; • Phishing tests conducted at least quarterly on a global basis, with additional periodic phishing tests conducted with high-risk employee groups; • Channels for employees to report suspicious emails or other activity and the actual or suspected loss, theft, improper use of or access to IDEXX systems or information; • Deployment and ongoing assessment of the effectiveness of technological tools aimed at preventing, detecting, and mitigating cybersecurity threats; • Policies and procedures to assess third-party service provider cybersecurity risks and security controls and measures (as part of our procurement process and periodically thereafter); • Periodic performance of cybersecurity tabletop exercises; • Regular review of and, as applicable, updates to our cyber incident response plan and protocols, system backup measures, redundancy planning and disaster recovery plans; and • Maintenance of a cyber risk insurance policy to help address risk of loss due to certain types of cybersecurity events.

companyName: IDEXX LABORATORIES INC /DE

ticker: IDXX


text: Our Information Technology (IT) Management team is responsible for conducting risk assessments, designing the Information Security Program, overseeing service provider arrangements, establishing risk-based response programs for incidents involving unauthorized data access, providing staff training, conducting testing of key controls, systems, and procedures, and adjusting the program to reflect changes in people, processes, technology, sensitive information, threats, and the business environment (e.g., mergers, acquisitions, alliances, joint ventures, or outsourcing arrangements).

companyName: BANNER CORP

ticker: BANR


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our board of directors assesses risks based on probability and potential impact to key business systems and processes as part of our overall risk management program overseen by the board of directors. Risks that are considered high are incorporated into our overall risk management program. We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes and to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services. Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have no t materially affected our Company, including our business strategy, results of operations, or financial condition. Refer to the risk factor captioned "Cyber security risks and the failure to maintain the integrity of company, employee or guest data could expose us to data loss, litigation and liability, and our reputation could be significantly harmed." in Part I, Item 1A. "Risk Factors" for additional details regarding cybersecurity risks and potential impacts on our business.

companyName: Sintx Technologies, Inc.

ticker: SINT