text: Cybersecurity risk management is a key component of our overall risk management efforts at Franklin Covey. We have cybersecurity processes, technologies, and controls in place to assist in our efforts to assess, identify, and manage material risks from cybersecurity threats that may impact the confidentiality, integrity, and availability of our information systems, networks, and offerings. Cybersecurity risk is addressed at both management and Board of Director levels as described below.

companyName: FRANKLIN COVEY CO

ticker: FC


text: The program is managed by our executive management team, and includes mechanisms, controls, technologies, systems, policies, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the systems and data residing in them. We consult with and rely upon outside advisors and experts to assist us with assessing, identifying, and managing cybersecurity consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Our Board of Directors has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Board of Directors receives periodic updates on cybersecurity and information technology matters and related risk exposures from management.

companyName: ALLIANCE ENTERTAINMENT HOLDING CORP

ticker: AENT

secItem: Item 1C


text: We often engage with specialized third-party assessors, consultants, auditors, and other experts to review, validate, and enhance our cybersecurity practices. Their independent assessments provide an external perspective on our cybersecurity posture, allowing us to leverage best practices from the industry and ensure our defenses remain robust. All third parties engaged for such processes are subjected to rigorous scrutiny to ensure they meet our security standards, and the engagements are documented and reviewed periodically.

companyName: TRANSCONTINENTAL GAS PIPE LINE COMPANY, LLC


text: We strive to make sure that the entire company is up to date with their responsibility and understand the importance of their contributions to staying cyber secure through a robust training and education program. Employees and contractors are responsible for taking mandated cyber training on an annual basis. We also run phishing exercises on a routine basis to help ensure employees can recognize and report in appropriate activity and social engineering attempts.

companyName: AMERICAN PUBLIC EDUCATION INC

ticker: APEI


text: Our comprehensive incident response plan outlines detailed procedures for addressing and recovering from cybersecurity incidents. This plan, which is integrated with our business continuity and disaster recovery strategies, aims to ensure operational resilience and timely remediation of affected systems.

companyName: Astrana Health, Inc.

ticker: ASTH


text: Our Board of Directors (Board) is responsible for oversight of our risk management programs and assisting management in addressing specific risks, including cybersecurity risks. The Audit Committee assists our Board in reviewing cybersecurity and other information technology risks, controls and procedures, including our plans to mitigate cybersecurity risks and to respond to data breaches. The Audit Committee also helps in reviewing with management any specific cybersecurity issues that could have a material impact on us. Our Chief Information Officer (CIO) provides the Board with updates on cybersecurity risks at regularly scheduled board meetings at least twice a year. These updates include the results of any third-party reviews and related remediation items.

companyName: POOL CORP

ticker: POOL


text: We engage an external Head of Information Technology, or IT, consultant to work with the company, including the Chief Operating Officer, Chief Financial Officer, and Executive Leadership Team, to help identify, assess and manage the company's cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, and evaluating threats reported to us.

companyName: Equillium, Inc.

ticker: EQ


text: For additional information about the risks from cybersecurity threats that may materially affect us and how they may do so, see the section entitled "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K, including "If our information technology systems or those third parties with whom we work, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm and other adverse consequences."

companyName: Lyell Immunopharma, Inc.

ticker: LYEL


text: Given the Company's status as a pawn store operator and payment solutions company entrusted with the safeguarding of sensitive customer information, the Board believes that a strong enterprise cybersecurity program is vital to the Company's overall enterprise risk management. The Board is responsible for overseeing and monitoring the material risks facing the Company. The Board has tasked the Audit Committee of the Board with leading the Company's cyber and technology risk mitigation efforts. As part of its oversight responsibilities, the Audit Committee is responsible for discussing with management the Company's major risk exposures, related to cybersecurity and technology, and the steps management has taken to monitor and control those exposures, including the Company's risk assessment and risk management policies. The Audit Committee also monitors the Company's compliance with legal and regulatory requirements and the risks associated therewith. On a regular basis, the Audit Committee reviews with senior management significant areas of risk exposure involving cybersecurity.

companyName: FirstCash Holdings, Inc.

ticker: FCFS


text: We have not identified risks from known cybersecurity threats as a result of any prior cybersecurity incidents that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face complex risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—We and our third-party providers may be vulnerable to cyberattacks and security breaches that could materially disrupt or compromise our operations, data and results." There can be no assurance that our cybersecurity risk management processes, including our policies, controls or procedures, will be fully implemented as currently anticipated, complied with or effective in protecting our systems and information or in allowing us to recover from a cybersecurity incident.

companyName: DIGITAL REALTY TRUST, INC.

ticker: DLR


text: Overseeing the assessment and management of our exposure to various risks, including cybersecurity, is a key oversight responsibility for the Board of Directors. These risks are identified, measured, monitored, and managed across key risk categories, which include the consideration of cybersecurity risks. Our chief financial officer (CFO) facilitates the Company's oversight, which includes an assessment of our risk environment at least once per year. The review incorporates risk assessment and evaluation. The Audit Committee assists the Board with its oversight of cybersecurity risk. Our CFO reviews the oversight program with the Audit Committee, including reviewing existing risks and significant emerging risks across the Company's key risk categories. In reviewing specific threats and risks with the Board, senior management may incorporate reports from consultants and other third-party advisors.

companyName: BT Brands, Inc.

ticker: BTBD


text: We have formal policies and procedures addressing data retention, incident response, asset and device management and have a Disaster Recovery and Business Continuity Committee that meets biannually to review and update our plan, policies, and procedures to align with changes in risk assessment and emerging technologies. In addition, our Information Technology team conducts disaster recovery tests annually and reports results to the Cyber Steering Committee. A cybersecurity breach may result in disruption of our operations, damage to our reputation and cause us to lose revenue or incur significant expenses to remediate which could have a material adverse effect on our results of operations or consolidated financial position.

companyName: Urban Edge Properties

ticker: UE


text: We use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including professional services firms, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, and dark web monitoring services.

companyName: MACROGENICS INC

ticker: MGNX


text: Our Director of Information Security leads the Information Security Program and reports to the CIO, who also provides additional oversight of the Program. The Director of Information Security has over 18 years of experience in the information technology and information security fields and the CIO has over 28 years of experience in the information technology and information security fields. In addition, we have established a Security Steering Committee that provides guidance and direction to the CIO regarding the Information Security Program, including approval of the Program mission and its objectives. The Security Steering Committee meets at least quarterly and its membership includes, at a minimum, the Director of Information Security, the CIO, the COO, the CFO, the Sr. Vice President of Engineering and Operations, the VP of Legal/General Counsel and the CEO. Information security risks are reviewed with the Security Steering Committee periodically or as needed.

companyName: SHENANDOAH TELECOMMUNICATIONS CO/VA/

ticker: SHEN


text: We face a number of cybersecurity risks in connection with our business. During the past three years we have not suffered a material breach or a reportable incident, and cybersecurity risks (including breach of third parties with whom we work) have not materially affected us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see Item 1A. Risk Factors.

companyName: HASBRO, INC.

ticker: HAS


text: Related to Cybersecurity Risks Our Board of Directors oversees Moderna's overall risk management strategy. The Board exercises oversight of risks from cybersecurity threats primarily through its Audit Committee, which oversees our risk management processes for information security and technology risks. Our cybersecurity risk management processes are integrated into our overall risk management strategy, which is overseen by the Audit Committee. At least annually, the Audit Committee discusses our risk management program, including information security and technology risks and findings from any audits, with our internal audit staff.

companyName: Moderna, Inc.

ticker: MRNA


text: Cybersecurity incidents may be detected through a variety of means, including employee notification to our IT personnel, notification from external parties (e.g., customers, vendors, or service providers), and automated event-detection notifications. Once a potential cybersecurity incident is identified, IT personnel assigned to the incident assess the severity of the event and sensitivity of any compromised data and follow the reporting and escalation procedures set forth in the incident response plan. Events that could have a high impact or that require additional judgment are escalated to the ISC. The ISC designates an incident response team to continue investigation of the incident to determine the extent of exposure and damage, and works to contain the damage and isolate the affected system, apply security measures and ultimately recover systems.

companyName: CRA INTERNATIONAL, INC.

ticker: CRAI


text: The Company's President and Chief Executive Officer, Chief Financial Officer and Treasurer, Chief Operating Officer and General Counsel and Secretary ("Senior Management") are responsible for assessing and managing cybersecurity risks with the support of the entire CSIR Team, led by the Director of Operations/Risk Management. The Director of Operations/Risk Management is the primary lead for monitoring the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and ensuring that the Cybersecurity Policies are followed. Senior Management works collaboratively with the Director of Operations/Risk Management and the entire CSIR Team to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Cybersecurity Policies. The CSIR Team also includes a third-party, on-demand IT support team, a Primary IT Support Contact, who is the technical response lead, a Primary Communications Contact responsible for handling external communications during and after an incident, as well as other delineated primary contacts in areas including, but not limited to, HR, Legal, Accounting, Asset Management and Acquisitions. Pursuant to the Cybersecurity Policies, information security incidents must be reported, without delay, to the IT support team or the Director of Operations/Risk Management, who will then advise Senior Management of the incident. Senior Management will then report such threats and incidents to the Audit Committee, when appropriate.

companyName: Chiron Real Estate Inc.

ticker: XRN


text: Cybersecurity governance at the Company involves executive and Board oversight. Our Board of Directors considers cybersecurity risks as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee regularly receives updates from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: Our VP of Information Technology provides annual briefings to the audit committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our VP of Information Technology or department designee provides annual briefings to the board of directors on cybersecurity risks and activities.

companyName: PMV Pharmaceuticals, Inc.

ticker: PMVP


text: We believe that cybersecurity is fundamental to how we operate and as such we place significant focus on defining and managing our cybersecurity risk. With the ever-changing cybersecurity landscape and continual emergence of new threats, our Board of Directors, Audit Committee and senior management team ensure that significant resources are devoted to cybersecurity risk management and the technologies, processes and people that support it. We have an Enterprise Risk Management Committee, comprising senior leaders from key functions, and a Cybersecurity Risk Committee which utilize the National Institute of Standards and Technology ("NIST") framework to ensure that these risks are clearly and effectively categorized and treated.

companyName: GXO Logistics, Inc.

ticker: GXO


text: We have policies, procedures and processes in place to identify, assess and monitor material risks from cybersecurity threats. These plans are part of our overall enterprise risk management strategy and are part of our operating procedures, internal controls, and information systems. Cybersecurity risks include, among other things, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risks, and reputational risks. We have developed and implemented a cybersecurity framework intended to assess, identify and manage risks from threats to the security of our information, systems, and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, although this does not imply that we meet all technical standards, specifications or requirements under the NIST.

companyName: ETHAN ALLEN INTERIORS INC

ticker: ETD


text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm or damage to our brand, lost sales, physical damage to facilities, physical harm to individuals, reduced demand, loss of intellectual property rights, significant costs or the Company being subject to government investigations, litigation, fines or damages. For additional information, see Part I, Item 1A, "Risk Factors—Operational Risks—Information technology systems failures, data security breaches, cybersecurity attacks or network disruptions have harmed us in the past and could compromise our information, disrupt our operations and expose us to liability, which may adversely impact our operations."

companyName: CABOT CORP

ticker: CBT


text: The company maintains a cybersecurity risk management program as part of its overall risk management framework and regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities and tests those systems pursuant to the company's cybersecurity standards, processes, and practices. To protect the company's information systems from cybersecurity threats, the company uses various security tools that help the company identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. These efforts include but are not limited to, internal reporting, engaging third-party service providers to actively monitor information systems, performing vulnerability testing using external third-party tools and techniques to test security controls, conducting employee training, monitoring emerging trends and regulations related to information security, and implementing appropriate changes, as needed, to our cybersecurity risk management program.

companyName: MIDDLEBY Corp

ticker: MIDD


text: To date, risks from cybersecurity threats have not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents. For more information about cybersecurity-related risks, please refer to the section entitled "Risk Factors" in this Annual Report on Form 10-K.

companyName: Olo Inc.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example: cybersecurity consultants, managed cybersecurity service providers, and professional service firms, including legal counsel, forensic investigators, and penetration testing service providers.

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems. Education and Awareness.

companyName: Apollo Infrastructure Co LLC


text: Our management team is responsible for the day-to-day management of risks we face, including our Vice President – Information Security Officer. Our current Information Security Officer has over 15 years of experience, including prior work in the healthcare field, and is a Certified Information Systems Security Professional and CompTIA Security+ certified.

companyName: LAKELAND FINANCIAL CORP

ticker: LKFN


text: In 2023, we upgraded our enterprise resource planning system to enhance operating efficiencies and provide more effective management of our business operations. The upgrade was substantially completed in the third quarter of 2023. The upgrade included training of personnel, migration of data, and maintaining effective internal controls.

companyName: ORTHOPEDIATRICS CORP

ticker: KIDS


text: We continue to invest in cybersecurity and resiliency of our networks and adapt our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Item 1A "Risk Factors."

companyName: SKECHERS USA INC


text: Processes for Informing the Board: The audit committee is regularly informed about cybersecurity risks through quarterly briefings from our President and COO. These briefings may include risk assessment reports, incident response updates, changes to the cybersecurity landscape, and other relevant information. In the case of a cybersecurity incident that meets reporting thresholds, the audit committee will be promptly notified and will receive continual updates until the situation is remedied.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. Our Senior Vice President ("SVP") of Information Technology and the Vice President ("VP") of Information Security have overall responsibility for assessing and managing our material risks from cybersecurity threats. To help ensure effective oversight, the Audit Committee receives reports on information security and cybersecurity at least annually, and receives an update quarterly on information security and cybersecurity from materials provided by the VP of Information Security.


text: Our vendor management program is designed to identify the risks associated with using third-party service providers to run our business. Third-party service providers that present cyber risk to our operations must meet specific criteria, such as the maintenance of appropriate controls, processes and monitoring to ensure the confidentiality, integrity and availability of data and resources prior to being onboarded. In addition to initial assessments of our critical third-party service provides, we perform regular on-going monitoring of these critical third parties' infrastructure and performance, including data security and the effectiveness of their cybersecurity risk management programs.

companyName: SR Bancorp, Inc.

ticker: SRBK


text: We rely on certain third-party computer systems and third-party service providers, including global distribution systems ("GDSs") and computerized central travel reservation systems in connection with providing some of our services. We also depend upon various third parties to process payments for our transactions around the world. These third party business partners, service providers, and consultants need to access our customer and other data, and connect to our computer networks. We define expected security and privacy requirements through our contracting processes with third parties and we perform third-party cyber risk assessments to monitor the cyber risk management efforts of third parties as needed.

companyName: Booking Holdings Inc.

ticker: BKNG


text: Our Executive Director of IT has over 28 years of experience in leading IT teams and managing cybersecurity in several industries including biotech, media and consumer products. He has hands-on experience as an IT network engineer and systems administrator, configuring and hardening systems against security threats. In addition, he has previously held executive-level leadership IT roles. Throughout his career, he has kept abreast of new developments in cybersecurity and has implemented industry standards to secure IT infrastructure and systems. He works closely with the Company's IT managed service provider to assess all security incidents and events and escalate as needed.

companyName: Passage BIO, Inc.

ticker: PASG


text: Our cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") cybersecurity framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Kimco Realty OP, LLC


text: establishing clear and specific contractual terms and conditions regarding the Company's cybersecurity expectations, obligations, and the responsibilities of the service providers;

companyName: AGREE REALTY CORP

ticker: ADC


text: Our employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, vulnerability scanning, third-party monitoring, and threat intelligence.

companyName: BV Financial, Inc.

ticker: BVFL


text: Centuri conducts quarterly cybersecurity reviews with its Executive Leadership Team. The review outlines the state of cybersecurity practices at Centuri through the lens of the NIST Cybersecurity Framework ("NIST CSF"). Details relative to the progress of specific goals and objectives are communicated to ensure alignment with leadership expectations. Centuri has developed policies and implemented procedures to meet the security control objectives provided within the NIST CSF, as well as applicable Centuri policies. Centuri's cybersecurity team performs a variety of internal operational risk assessment activities to track and mitigate risks to the organization. These operational practices cross a variety of management activities and a list of these activities is maintained in a Cybersecurity Risk Register for tracking the status of risk mitigation activities, as well as the overall maturity of the organization relative to the NIST CSF. Centuri further engages third parties to perform both targeted and holistic evaluations of Centuri cybersecurity practices on a regular basis.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: We regularly evaluate cybersecurity risks through discussions and updates with our Chief Executive Officer ("CEO"), who oversees our cybersecurity strategy. The CEO ensures that our management team can identify, evaluate, and manage cyber risks effectively and deploy measures to address and mitigate potential cyber incidents. This governance structure ensures that cybersecurity remains a central element of our strategic planning and risk management philosophy.

companyName: Crypto Co

ticker: CRCW


text: We have a security incident response framework in place. We use this incident response framework as part of our process to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The framework is a set of coordinated procedures and tasks that our incident response team, under our CEO's direction, executes to ensure timely and accurate resolution of cybersecurity incidents. Our cybersecurity framework includes regular compliance assessments with our policies, standards, and applicable state and federal statutes and regulations. In addition, we validate compliance with our internal data security controls through security monitoring utilities and internal and external audits.

companyName: IZEA Worldwide, Inc.

ticker: IZEA


text: Our Board of Directors has oversight of our enterprise risk assessment and risk management processes, as well as the steps taken to mitigate these risks, including for cybersecurity matters. The Audit Committee of our Board of Directors has oversight of cybersecurity risk assessment and risk management policies as part of its risk management oversight responsibilities, and is responsible for ensuring that the Company has processes in place to identify, evaluate and manage cybersecurity risks, as well as appropriate processes and programs to mitigate cybersecurity incidents if they occur. The Audit Committee actively engages in cybersecurity risk discussions and receives periodic updates on the Company's cybersecurity program from our CISO, including updates on various cybersecurity matters such as risk assessments, threats, incidents, prevention, detection and remediation of incidents, mitigation strategies, areas of emerging risk and industry trends, among other topics. Significant cybersecurity matters, including those related to incidents, are escalated to the Board of Directors.

companyName: MASTEC INC

ticker: MTZ


text: The Chief Information Officer ("CIO") plays a pivotal role in informing the Audit Committee on cybersecurity risks. The CIO provides briefings to the Audit Committee on a quarterly basis. These briefings encompass a broad range of topics, including: current cybersecurity landscape and emerging threats; status of ongoing cybersecurity initiatives and strategies;

companyName: HUNTSMAN INTERNATIONAL LLC


text: The Company maintains an Enterprise Risk Committee ("ERC"), comprising the Company executives who lead day-to-day risk management, and whose efforts are supplemented by specific risk-related committees or teams. The ERC is a cross-functional committee that focuses on identifying and managing operational risk throughout the organization, including cybersecurity threats. The ERC has integrated cybersecurity into key elements of the Company's ERM framework, including our BCDR planning program and service provider management policy, and personnel from our information security, risk management, compliance and legal groups are a part of the assessment and response team for cybersecurity incidents and the evaluation of third-party cybersecurity risk.

companyName: VIRTUS INVESTMENT PARTNERS, INC.

ticker: VRTS


text: As of February 28, 2024, we do not believe that any past cybersecurity incidents have had, or are reasonably likely to have, a material adverse effect on the company, including our business, operations or financial condition. However, there can be no assurance that MPC's cybersecurity processes will prevent or mitigate cybersecurity incidents or threats and that efforts will always be successful. It is possible that these events may occur and could have a material adverse effect on our business, operations or financial condition. See "Business and Operational Risks--We are increasingly dependent on the performance of our information technology systems and those of our third-party business partners and service providers" in Item 1A. Risk Factors of this Annual Report on Form 10-K.

companyName: MPLX LP

ticker: MPLX


text: We are not aware of any risks from cybersecurity threats, nor have we experienced any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors" in this Form 10-K for discussion of risk factors.

companyName: Stabilis Solutions, Inc.

ticker: SLNG


text: The collective framework, regulatory compliance requirements, and associated controls are collectively referred to as the ISMS. The ISMS provides a comprehensive structure that supports the Information Security Program designed to safeguard information technology resources, maintain the confidentiality, integrity and availability of data, and manage the resources used to provide technology and security services to the organization.

companyName: BOK FINANCIAL CORP

ticker: BOKF


text: We have a cybersecurity program to safeguard our information systems and data, which includes policies, processes and controls designed to protect against cybersecurity threats.

companyName: STERLING INFRASTRUCTURE, INC.

ticker: STRL


text: Security Controls and Continuous Monitoring Security controls and design are critical to mitigating risks. The Company works to protect its computing environments and products from cybersecurity threats through multi-layered defenses and applies lessons learned from its defense and monitoring efforts to help prevent future attacks. The Company utilizes data analytics to detect anomalies and monitor for possible cyber threats. The Company's Cybersecurity Operations Center provides comprehensive cyber threat detection and response capabilities and maintains a 24x7 monitoring system which complements the technology, processes and threat detection techniques the Company uses to monitor, manage and mitigate cybersecurity threats. From time to time, the Company engages third party consultants or other advisors to assist in assessing, identifying and/or managing cybersecurity threats. The Company's Internal Audit function also conducts information technology and cybersecurity reviews and assessments.

companyName: BANCFIRST CORP /OK/

ticker: BANF


text: While Corning has had to address various cybersecurity threats in the ordinary course of its business, we have not identified risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: CORNING INC /NY

ticker: GLW


text: The Chief Information Security Officer ("CISO") reports to the Chief Information Officer ("CIO") and Chief Risk Officer ("CRO"). The CISO leads the Information Security team, which is responsible for identifying and assessing information security and cybersecurity risks, and for implementing and maintaining controls to manage information security and cybersecurity threats. The CISO is responsible for the Bank's Information Security and Cybersecurity Program, which is designed to prevent, detect and respond to cybersecurity threats and incidents in order to help safeguard the confidentiality, integrity and availability of the Bank's information systems and information.

companyName: RBB Bancorp

ticker: RBB


text: The Audit Committee of the board of directors oversees cybersecurity risk and is comprised of three independent members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. The chair of our Audit Committee holds a Certificate in Cybersecurity Oversight from the National Association of Corporate Directors and has previous work experience at a large retailer with point-of-sale cybersecurity exposure. The Audit Committee receives quarterly updates summarizing on-going information technology and cybersecurity initiatives from our Chief Financial Officer and reviews the results of our annual risk assessment and regular cyber risk assessment upon completion. Any significant issues identified are reported to the Audit Committee of the board of directors on a quarterly basis. As described above, our management team is responsible for the day-to-day assessment and management of material risks from cybersecurity threats through our Chief Financial Officer, our standing management committee on information technology and cybersecurity risk matters and the MSSP. This group would be notified through our Incident Response Plan/Policy and appropriate actions undertaken in accordance with the plan document if a cyber-attack were to occur.

companyName: Piedmont Realty Trust, Inc.

ticker: PDM


text: During the fiscal year ended December 31, 2023, we did not identify risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, there is no guarantee that a future cybersecurity incident would not materially affect our business. For more information about the cybersecurity risks we face, see the risk factor entitled "Any failure of our management information systems, including as a result of a cybersecurity event or other system breach, could harm our business and operating results" under Item 1A., "Risk Factors" of this Form 10-K.

companyName: AGILITI, INC. \DE


text: Despite the security measures and safeguards FirstEnergy has employed, including certain measures implemented pursuant to mandatory NERC Critical Infrastructure Protection standards, FirstEnergy's infrastructure may be increasingly vulnerable to such attacks as a result of the rapidly evolving and increasingly sophisticated means by which attempts to defeat security measures and gain access to information technology systems may be made. Also, FirstEnergy, or its vendors and service providers, may be at an increased risk of a cyber-attack and/or data security breach due to the nature of its business. Any such cyber incident could result in significant lost revenue, the inability to conduct critical business functions and serve customers for a significant period of time, the use of significant management resources, legal claims or proceedings, regulatory penalties, significant remediation costs, increased regulation, increased capital costs, increased protection costs for enhanced cyber security systems or personnel, damage to FirstEnergy's reputation and/or the rendering of its internal controls ineffective, all of which could materially adversely affect FirstEnergy's business, results of operations, financial condition and reputation.

companyName: FIRSTENERGY CORP

ticker: FE


text: As of the date of this filing, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information, see Part I, Item 1A: Risk Factors— Risks Relating to our Business: We are susceptible to cybersecurity breaches and cyber-related fraud.

companyName: Beeline Holdings, Inc.

ticker: BLNE


text: Our cybersecurity program is aligned with industry standards and reasonable security safeguards for comparable companies in our industry. We also actively engage with industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. We may engage consultants from time to time to assist us with assessing and improving our cybersecurity program.

companyName: Zentalis Pharmaceuticals, Inc.

ticker: ZNTL


text: The Adviser's CISO has over 9 years of experience managing risks from cybersecurity threats and developing and implementing cybersecurity policies and procedures. The responsibility of the CISO is to maintain confidentiality, availability, and integrity of the Adviser's data and that of its clients and shareholders. The CISO also reports to the Adviser's Enterprise Operations Committee on a semiannual basis. The committee is charged with determining the security posture of the Adviser. It is responsible for accepting, deferring, or mitigating the risks presented by the CISO. The CISO is also responsible for maintaining all policies and controls pertaining to cybersecurity and conducting annual risk assessments. The Company's CCO has over 15 years of experience advising on and managing compliance risks, including those related to cybersecurity, and developing and implementing policies and procedures to address such risks. The CCO reports to the general counsel of the Sub-Adviser and Administrator of the Company and to the Board on all compliance risk related matters, including those related to cybersecurity.

companyName: First Eagle Private Credit Fund


text: Our CISO has over seven years of experience running cybersecurity programs and also served as the leader of the cybersecurity team at his previous organization. Effective March 1, 2024, our CISO will be departing the Company, and our Deputy CISO will be promoted to the CISO role at that time. Our Deputy CISO has over 25 years of experience working in security and infrastructure for SaaS and hosted services. She has a master's degree in cybersecurity and has maintained an active CISSP certification since 2012.The CISO reports to the Chief Technology Officer, who has overseen the cybersecurity team since 2020 and has led infrastructure teams at the Company for over 11 years.

companyName: HUBSPOT INC

ticker: HUBS


text: Our board of directors is responsible for oversight of our risk assessment, risk management and cybersecurity risks. Our board of directors engage in discussions with management on cybersecurity-related news and discuss any updates to our cybersecurity risk management and strategy programs that are necessary.

companyName: GPODS, INC.


text: Our Board of Directors (Board) oversees NACCO's risk management. Our full Board regularly reviews information provided by management to oversee risk identification, risk management and risk mitigation strategies. The Audit Review Committee assists the Board with cybersecurity risk oversight. The Audit Review Committee is responsible for regularly reviewing and discussing with management risk exposure relating to cybersecurity, which includes reviewing the state of our cybersecurity program and emerging cybersecurity developments and threats, as well as the steps management has taken to monitor and mitigate such exposure. In 2024, our Board and the Audit Review Committee received periodic updates throughout the year on cybersecurity matters and these updates are part of their standing agendas.

companyName: NACCO INDUSTRIES INC

ticker: NC


text: The lead management team member responsible for cybersecurity matters is the CAO, who has 20 years of experience in information technology and a B.A. in Management Information Systems. She is assisted by the Vice President of Technology Operations, the Information Security Manager and Corporate Counsel, Privacy. The CAO regularly reviews the lines of accountability and responsibility to ensure alignment with the ERM Committee.

companyName: UNITED FIRE GROUP INC

ticker: UFCS


text: We employe an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employe a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: FIRST UNITED CORP/MD/

ticker: FUNC


text: Our Board of Directors (the "Board") is aware of the critical nature of managing risks associated with cybersecurity threats. In recognition of the significance of these threats to our operational integrity and shareholder confidence, the Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats.

companyName: Array Technologies, Inc.

ticker: ARRY


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impacted our strategic plan, operations, or financial standing. For additional information, see "Item 1A. Risk Factors - We are subject to security risks related to our products as well as our information and technology systems".

companyName: Trulieve Cannabis Corp.

ticker: TCNNF


text: As described in Item 1A – Risk Factors, we are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations, and reputation. We recognize the critical importance of assessing, identifying, and managing material risks associated with cybersecurity threats, and have integrated a comprehensive cybersecurity program into our broader Enterprise Risk Management ("ERM") framework. This integration ensures that cybersecurity considerations are an integral part of our decision-making process at every level. Our cybersecurity program includes a detailed set of policies, standards, and procedures informed by an industry-leading framework established by the National Institute of Standards and Technology ("NIST CSF"). The NIST CSF provides a model that emphasizes identification, protection, detection, response, and recovery. To identify and manage risks from third parties in relation to cybersecurity, we conduct thorough cybersecurity assessments of third party service providers and include specific cybersecurity obligations in our contracts. Additionally, we continuously monitor these providers and require prompt notification of any cybersecurity incidents to manage and monitor potential risks to our business, financial condition, results of operations, and reputation.

companyName: WINNEBAGO INDUSTRIES INC

ticker: WGO


text: The Company has a comprehensive incident response plan to address cybersecurity incidents. The Company's incident response plan includes procedures for identifying, containing and responding to cybersecurity incidents and is subject to regular review and assessment to ensure that it is effective in protecting the Company's information technology. To date, the Company believes that its cybersecurity program has been effective in protecting the confidentiality, integrity, and availability of its information; however, the Company cannot guarantee that its cybersecurity program will be successful in preventing all cybersecurity incidents. Further, we currently maintain a cyber insurance policy that provides coverage for security breaches; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.

companyName: HERSHEY CO

ticker: HSY


text: We rely heavily on our supply chain to deliver our products and services to our customers, and a cybersecurity incident at a supplier, subcontractor or third-party partner could materially adversely impact us. To address this, our vendor management process involves different levels of assessment depending on the services provided by the vendor, the sensitivity of the related information systems and data, and the identity of the provider. It is designed to help identify cybersecurity risks associated with a vendor and work with the vendor to address or mitigate those risks.

companyName: METHODE ELECTRONICS INC

ticker: MEI


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) we prioritize our risk management processes to include mitigation of risks from cybersecurity threats that are more likely to lead to a material impact to our business; (3) management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee, which evaluates our overall enterprise risk.

companyName: SCYNEXIS INC

ticker: SCYX


text: Cybersecurity risk management and oversight are of utmost importance to Air Products and are necessary to maintain the trust and confidence of our customers, employees, and other stakeholders. The Company has implemented a thorough cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats as a fully integrated component of the Company's overall Enterprise Risk Management ("ERM") process.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: Our Head of Information Security oversees our cybersecurity policies and processes, including those described above under "Risk Management and Strategy." The processes by which he is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following: vulnerability management, third party risk management, data security management, security awareness training, systems management, operations security, security incident and event management, and incident response management. We utilize third parties for managed detection and active response to cybersecurity incidents.

companyName: Sana Biotechnology, Inc.

ticker: SANA


text: The Board of Directors oversees the work of all of its committees, including the Risk and Sustainability Committee. The Risk and Sustainability Committee is responsible for overseeing the Company's strategic and integrated risk practices, including its approach to management and assessment of cybersecurity risks. The Chief Information Officer (CIO) provides annual and periodic updates to the Risk and Sustainability Committee and the Board of Directors on cybersecurity risks and the Company's implementation of its strategy for mitigating such risks. In addition, the Company's Chief Information Security Officer (CISO) also briefs the Risk and Sustainability Committee. The Audit and Finance Committee receives updates on information systems and cybersecurity audit and advisory engagements from the Chief Internal Auditor.

companyName: CANADIAN PACIFIC KANSAS CITY LTD/CN

ticker: CP


text: Training and Awareness The Company provides awareness training to its employees to help identify, avoid and mitigate cybersecurity threats. All employees with network access participate annually in required training, including spear phishing and other awareness training. The Company also periodically hosts tabletop exercises with management and other employees to practice cyber incident response.

companyName: BANCFIRST CORP /OK/

ticker: BANF


text: Management is responsible for identifying and assessing material risks for the business on an ongoing basis, including in relation to cybersecurity. As part of this process, our IRT is tasked with implementing and maintaining our cybersecurity programs, including establishing processes to ensure that potential cybersecurity risk exposures are monitored and putting in place appropriate mitigation measures. Our Chief Financial and Business Officer oversees our information technology department which monitors the prevention, detection, mitigation, and remediation of cyber incidents, if any, and reports all potential incidents and an initial assessment of such incident to the IRT. Our Chief Financial and Business Officer has over 6 years of experience with overseeing risk, compliance, and information technology functions.

companyName: Nkarta, Inc.

ticker: NKTX


text: Murray, our Operations Manager, is responsible for assessing and managing cybersecurity risks. Mr. Murray is experienced in assessing and managing cybersecurity risks due to his direct oversight of our internet and digital communications contractors.

companyName: FLEXIBLE SOLUTIONS INTERNATIONAL INC

ticker: FSI


text: Bancorp's Credit and Risk Committee, which includes board of director representation, maintains a robust oversight framework for evaluating and managing risks associated with cybersecurity threats. The committee convened six times during the year ended December 31, 2023 in order carry out its oversight responsibilities, engaging directly in discussions about cybersecurity risks to ensure they are comprehensively addressed within the institution's risk management framework. This included, but was not limited to, vulnerability trends, identified or potential third-party risks, risks precipitated by technological changes, confirmed or potential security incidents, policy and procedure changes, the organization's risk appetite, the FFIEC's Cybersecurity Assessment Tool, conclusions from the risk assessment, audit and regulatory reports, routine quarterly and annual reporting, as well as other notable key risk indicators.

companyName: Stock Yards Bancorp, Inc.

ticker: SYBT


text: Management and Board Oversight of Cybersecurity Risks The Company's management, including the Company's Executive Vice President of Technology and Chief Information Security Officer ("CISO"), are responsible for assessing and managing material risks from cybersecurity threats. Members of Company management possess relevant expertise in various disciplines that are key to effectively managing such risks.

companyName: Interactive Brokers Group, Inc.

ticker: IBKR


text: We also conduct the following activities at various intervals during the year, which vary in maturity across our business: • monitor emerging data protection laws and implement changes from time-to-time to our processes designed to comply; • undertake regular reviews of our customer facing policies and statements related to cybersecurity; • through policy, practice, and contract (as applicable) require employees, who provide services on our behalf, to treat customer information and data with care; • leverage the NIST incident handling framework to help us prepare, detect, analyze, contain, eradicate, respond, and recover when there is an actual or potential cybersecurity incident; • run exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • run exercises to simulate a response to a cybersecurity incident to provide training to our cyber incident response team; • run annual tabletop exercises to train our executives and increase their cybersecurity awareness; • conduct a variety of information security and privacy trainings, including new employee training, job-specific security training, specialized training for IT and security personnel, and phishing simulations. • hold an annual Cybersecurity Awareness Month programming, which is available for all employees during which we provide seminars, presentations, and employee engagement activities designed to reinforce our employee information security training and enhance the culture and knowledge of cybersecurity risks among our employees; • carry information security risk insurance to help defray potential losses that might arise from a cybersecurity incident.

companyName: JUNIPER NETWORKS INC


text: A cybersecurity incident response plan operationalized in a governance, risk, and compliance ("GRC") platform; and A third-party risk management process for enterprise software vendors that includes reviewing System and Organization Control 1 and 2 (SOC 1 and SOC 2) reports and onboarding and maintenance processes for suppliers that include cybersecurity assessments.

companyName: Clearfield, Inc.

ticker: CLFD


text: We have a specifically outlined incident response plan that documents the requirements of notification, classification, analysis and communication of security incidents, including cybersecurity incidents, based on the identified severity level. The CISO is informed of incidents at all severity levels pursuant to the incident response plan. The incident response plan also includes initial steps to convene the response team, contain the incident, consider insurance notification requirements, determine the type of incident and escalation, consider the communications protocol and consider involving law enforcement. In addition, the CISO is informed of potential cybersecurity incidents through the Company's IT incident response system, which contains security logs that are reviewed by the Company's 24/7/365 security operations center, and through the Company's enterprise incident response system, which involves both daily reports of potential issues and alerts that may be initiated by an employee or former employee of the Company.

companyName: HEIDRICK & STRUGGLES INTERNATIONAL INC


text: Management is committed to providing the Audit Committee with regular cybersecurity updates, at least annually or more often as needed, based on emerging threats or specific incidents. These updates cover risk assessments, the current threat landscape, and any recent cybersecurity incidents.

companyName: MDB Capital Holdings, LLC

ticker: MDBH


text: As part of its broader oversight activities, the Board oversees risks from information security threats and other risks identified by the RMC, both directly and by way of delegation to the Audit Committee. As reflected in its charter, the Audit Committee oversees and specifically discusses the guidelines and policies by which the Company assesses and manages its cybersecurity risk exposures, as well as the steps management has taken to monitor and control such exposures. The Audit Committee also oversees the Company's internal control over financial reporting, including with respect to financial reporting-related information systems. In addition to any communications of specifically identified cybersecurity events, the Audit Committee receives and discusses quarterly updates on cybersecurity activities, including review of annual external assessment results, training compliance and discussion of cybersecurity risks and resolutions, and is responsible for elevating significant matters to the full Board as events arise. The Board receives an annual update and provides feedback on the Company's cybersecurity governance processes, risk management plan, and any significant activities related thereto, and also reviews risk management practices in the course of its review of the Company's corporate strategy, business plans, Board committee reports, and other presentations. In addition to the ordinary-course Board and Audit Committee reporting and oversight described above, the Company also maintains disclosure controls and procedures designed for prompt reporting to the Board and timely public disclosure, as appropriate, of material events covered by our risk management framework, including information security risks.

companyName: SONOCO PRODUCTS CO

ticker: SON


text: Company recognizes the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We assess risks from cybersecurity threats against our information systems that may result in adverse effects on our information systems or any information residing therein. We conduct periodic assessments to identify cybersecurity threats.

companyName: Hongchang International Co., Ltd

ticker: HCIL


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants and managed cybersecurity providers.

companyName: Tectonic Therapeutic, Inc.

ticker: TECX


text: Our CIO has a Master of Science in Information Systems and has served in various roles in information technology for over 25 years. Our Cybersecurity Manager has served in various roles in information technology and information security for over 25 years, with 10 of those years as the leader responsible for enterprise cybersecurity, including serving as the Information Security Officer at another larger publicly traded company.

companyName: NPK International Inc.

ticker: NPKI


text: preparedness. These exercises are used to train and update the Company's Incident Response plan, including any gaps identified. The Company conducts yearly information security training for employees and conducts ongoing phishing tests.

companyName: PACCAR FINANCIAL CORP


text: As part of the Company's supplier risk management program, using a risk-based approach, the Cybersecurity team conducts formal risk assessments with respect to certain of the Company's third-party service providers. The assessment process addresses aspects of the service providers' data security controls and policies. The team also conducts reassessments of its third-party service providers, the frequency of which is determined based on a risk assessment and rating process. Where appropriate, the Company seeks to incorporate contractual language with third-party service providers that includes clear terms involving the collection, use, sharing and retention of user data, as well as compliance with appropriate security terms. Additionally, our Procurement group has a framework to help identify and mitigate supplier risks, as well as enable management to make risk informed decisions.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: Our current digital age has seen a remarkable growth in information technologies that allows for greater connectivity capabilities and faster sharing of data and information than ever before. These rapid advances in technology have been of great benefit to organizations like our own, which seek to deliver cutting-edge and life-enhancing solutions for our customers. In our pursuit of these objectives, we acknowledge and take seriously our responsibility to maintain the highest level of confidentiality, integrity, and availability of data belonging to our customers, prospects, external partners, and internal workforce members, and to protect our critical information technology systems and infrastructure against current and ever evolving cybersecurity threats and attacks.

companyName: Hyperfine, Inc.

ticker: HYPR


text: Our team members receive annual training to understand the behaviors necessary to protect company and personal information and receive annual training on privacy laws and requirements. We also offer ongoing practice and education for team members to recognize and report suspicious activity, including phishing campaigns.

companyName: AMN HEALTHCARE SERVICES INC

ticker: AMN


text: We are planning to establish an appropriate confidentiality framework and document management system in order to safeguard sensitive information in addition to the safeguards provided by our third-party service providers. Such confidentiality framework may include the use of third-party information technology experts to manage and oversee our sensitive information and to work directly with our management in overseeing cybersecurity risks and appropriate responses thereto. In addition, we plan to consult with outside advisors and experts, when appropriate, to assist with assessing and identifying cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.

companyName: PALISADE BIO, INC.

ticker: PALI


text: Our information security and risk management program is designed to identify, assess, and manage material risks from cybersecurity threats to our applications, computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, personal information, or PHI (collectively, "Information Systems").

companyName: OptimizeRx Corp

ticker: OPRX


text: The board implements its risk oversight function both as a board and through delegation to board committees, which meet regularly and report back to the board. The board has delegated the oversight of specific risks to board committees that align with their functional responsibilities. The Audit Committee (the "AC") assists the board in overseeing the enterprise risk management program and evaluates and monitors risks related to, among other things, the Company's information security program. The AC assesses cybersecurity and information technology risks and the controls implemented to monitor and mitigate these risks. The Company's Chief Information Officer & Senior Vice President, Caterpillar IT (the "CIO") attends all bimonthly AC meetings and provides cybersecurity updates to the AC and board.

companyName: CATERPILLAR INC

ticker: CAT


text: KKR also has a Chief Information Security Officer dedicated to our insurance business (the "GA CISO"), who has more than 20 years of experience in various information security and technology roles. The GA CISO leads an information security team that is focused on overseeing the cybersecurity strategy and program for Global Atlantic. The GA CISO reports periodically, including at least annually and more often as circumstances may require, to the risk committee of Global Atlantic's board of directors (whose members include non-executive directors unaffiliated with KKR) and members of KKR's risk and operations committee. The GA CISO also provides ad hoc reporting to Global Atlantic's management-level committees and Global Atlantic's board of directors and its risk committee. Material information affecting our insurance business is also reported by the GA CISO or his or her designee to KKR's risk and operations committee, certain members of which would, as appropriate, report such material information to our Board of Directors or its Audit Committee or Risk Committee.

companyName: KKR & Co. Inc.

ticker: KKR


text: In the event of a cybersecurity incident, we have an established incident response plan that requires prompt notification of the CEO and the Information Security and Privacy Executive Committee ("ISPEC"). The CEO and the ISPEC oversee the process for assessing the impacts of incidents, monitoring our mitigation and remediation efforts, and complying with any relevant laws and regulations.

companyName: RADIUS RECYCLING, INC.


text: Our Materiality Determination Committee is tasked with determining the materiality of cybersecurity incidents. Also, every week the CISO updates the Executive Leadership Team (CEO, President, CFO, Sr. VP of Operations, Chief Technology Officer ("CTO"), Chief Product Officer ("CPO"), and Sr VPs of Engineering) on cybersecurity matters including any confirmed incident or any possible threat with a material or otherwise meaningful impact and shares an updated dashboard with key performance indicators on on-going efforts and long-term metrics.

companyName: Satellogic Inc.

ticker: SATL


text: From time-to-time, we have identified cybersecurity threats that require us to make changes to our processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, results of operations and financial condition. We continue to evolve our controls to mitigate these threats as effectively as we can reasonably foresee them occurring.

companyName: HBT Financial, Inc.

ticker: HBT


text: We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our results of operations and financial condition, under the heading "Data breaches or incidents involving our technology could damage our business, reputation and brand and substantially harm our business and results of operations." in Item 1A, "Risk Factors" of Part I of this report.

companyName: Momentus Inc.

ticker: MNTS


text: We also implemented additional security measures following the incident, such as stronger privileged access policies and enhanced and expanded multi-factor authentication to help prevent unauthorized access to our systems. We face ongoing risks from certain cybersecurity threats, and we cannot provide assurance that, if those risks materialize, our business strategy, results of operations or financial condition will not be materially affected in the future. See "Risk Factors" in ITEM 1A of this Annual Report on Form 10-K for more information on our cybersecurity related risks.

companyName: SOMNIGROUP INTERNATIONAL INC.

ticker: SGI


text: As of this filing, no material cybersecurity incidents have occurred that would have a significant impact on the Bank's business, operations, or financial results. The Bank continues to monitor for any potential breaches and enhance its security protocols to prevent future incidents. While the Bank does not believe a cybersecurity threat is likely to materially affect the operations or financial condition, there can be no guarantee that the Bank will not experience such an incident in the future.

companyName: VWF Bancorp, Inc.

ticker: VWFB


text: Risk Assessment: At least annually, we conduct a cybersecurity risk assessment that takes into account information from our employees, known information security vulnerabilities, and information from external sources, including reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants. The results of the assessment are used to develop initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader Company-wide risk assessment that are then reported to our Board and members of management.

companyName: SOLITRON DEVICES INC

ticker: SODI


text: Index to Financial Statements • Regular training and compliance activities for our team members. Our team members receive annual training on information security, cybersecurity, and data privacy topics to understand the behaviors and technical requirements necessary to protect company and guest information, and appropriately collect, use, and share personal information. We also offer ongoing practice and education for team members to recognize and report suspicious activity. • Use of third parties. Beyond our in-house capabilities we engage with leading security and technology vendors to assess our information security and cybersecurity program and test our technical capabilities. • Insurance coverage. We maintain insurance coverage intended to limit our exposure to certain network security and privacy matters.

companyName: TARGET CORP

ticker: TGT


text: Various aspects of the Information Security Program are subject to periodic audit by the Company's Internal Audit department or third-party professionals engaged by the Internal Audit department. Such audits vary from year-to-year but are generally focused on compliance with stated control activities, standards, and internal policies, as well as maintaining the integrity and independence of the audit process. Cybersecurity risk reviews such as SOC2, SOX controls, Penetration Tests, and regulatory controls are conducted by independent third parties.

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: These processes are integral to our overall risk management system or processes and inform the identification and assessment of risks and mitigations through our Enterprise Risk Management (ERM) program. The ERM team, led by the SVP – Audit, Enterprise, Risk and Compliance (AERC) considers cybersecurity risks alongside other PSEG risks, and facilitates discussion with PSEG subject matter experts to identify cybersecurity risks, evaluate their potential severity and likelihood, identify mitigations, including those identified above, and assess the impact of those mitigations on residual risk. In addition, PSEG maintains a Risk Management Committee (RMC), responsible for assessing exposure to and determining PSEG's overall risk management strategy, including with respect to cybersecurity. The RMC, supported by the ERM function, is chaired by the SVP – AERC and consists of members of senior management including the CIDO and six other of the CEO's direct reports. In discharging its responsibilities related to cybersecurity threats, the RMC has received presentations from the CISO. To date, there has been no material impact or reasonably likely material impact on our business strategy, results of operations or financial condition from these attacks or other cybersecurity incidents, including as a result of prior cybersecurity incidents.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: The internal assessment process and internal tools and SOC related key indicators are reported on a quarterly basis to the Security and Information Security Committee and the Enterprise-wide Risk Management Committee and annually to the Board of Directors.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factors in Item 1A. Risk Factors in this report.

companyName: MDWerks, Inc.

ticker: MDWK


text: We recognize the importance of assessing, identifying, and managing risk associated with cybersecurity threats. Our external advisor has implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such risks. Our advisor has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: LUB LIQUIDATING TRUST


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, led by our Executive Director of IT & Cybersecurity, who has over 20 years' of work experience in IT and cybersecurity.

companyName: ACELYRIN, Inc.


text: Assessing, identifying, and managing cybersecurity related risks are integrated into our overall risk management program. Our Chief Executive Officer, General Counsel, and Vice President of Quality and Technical Operations directly oversee the development, implementation, operation, and revision of our cybersecurity policies and procedures, and are primarily responsible for the oversight of risks from cybersecurity threats and any security incidents that may occur. These officers have more than 21 years of combined experience in managing IT, operations, and information risk and security. Our Vice President of Quality and Technical Operations has experience developing comprehensive information security programs for organizations, and brings extensive experience in the private sector and is a specialist in IT governance strategies, risk management protocols, and compliance frameworks. All security incidents are managed by our Vice President of Quality and Technical Operations and reported to management, including our Chief Executive Officer, General Counsel, and other personnel based upon the specifics of the incident and its impact. Additionally, if a known or suspected security incident occurs at the Company, based upon its risk classification and if we assess the impact to be critical, the incident is escalated in a timely manner to the Audit Committee of the Board of Directors for oversight of the monitoring, reporting, and response process. The Audit Committee also oversees the implementation of our policies and procedures to prevent or reduce cybersecurity risks on an ongoing basis during the performance of its general committee duties.

companyName: Clene Inc.

ticker: CLNN


text: Program Adjustments. The VP IT monitors, evaluates, and adjusts the Information Security Program, considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.

companyName: Cullman Bancorp, Inc. /MD/

ticker: CULL


text: At the operational level, the Company has established an information security team, including a Privacy and Security Council ("PSC"), consisting of representatives from IT, Legal, HR, and Finance, to help provide governance and strategic direction for managing cyber risks, maintaining IT regulatory compliance, and optimizing technology initiatives for alignment with our company goals and objectives. Pursuant to various policies adopted by the Company since 2021, including the Company's Privacy Policy, the Company's senior most IT employee, our Information Security Coordinator (our "ISC"), is a member of the PSC and has frontline responsibility for assessing, identifying and managing material risks from cybersecurity threats. The PSC convenes not less than annually, and meetings include updates on cybersecurity matters provided by the information security team.

companyName: PULSE BIOSCIENCES, INC.

ticker: PLSE


text: We use third-party service providers to perform a variety of functions throughout our business, such as hosting companies, contract research organizations, contract manufacturing organizations and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessment for each vendor, system and organization controls reporting, and audits. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, as well as contractual obligations related to cybersecurity on the provider.

companyName: Regulus Therapeutics Inc.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Legal, the CFO, the CEO, and the IT department. Chimerix follows the cybersecurity incident response policy to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.

companyName: CHIMERIX INC


text: Our cybersecurity infrastructure undergoes external audits. These efforts demonstrate our commitment to maintaining the highest level of cybersecurity protection. Our external third-party providers also evaluate and rank our cybersecurity maturity and coverage as part of their services. To stay informed about emerging threats, we regularly consult with external providers and other sources such as government publications and notices.

companyName: VICOR CORP

ticker: VICR


text: In the event of a cybersecurity incident, dependent upon the nature of the incident, the Company has a Security Incident Response Team ("SIRT") that is comprised of employees who have responsibility and authority to act during a cyber incident without delay, including, dependent upon the nature of the incident, the Company's Chief Legal Officer, Chief Information Security Officer and Chief Information Officer. The SIRT includes individuals responsible for assessing, containing, and responding to incidents, as well as those responsible for assessing the business and legal impacts, reporting incidents as appropriate, communicating to internal and external stakeholders, and engaging with industry and government response partners to coordinate information and resource sharing when needed. During a cybersecurity incident, as warranted, the SIRT keeps the Company's senior leadership and Board apprised of the response to the incident, any operational or business impacts, and any internal or external communications regarding the incident. The SIRT will also seek the input of the Company's senior leadership and Board, as needed, when addressing a cybersecurity incident. Upon resolution of a cybersecurity incident, generally, the Audit Committee will review the incident, the impact and the mitigation efforts and remediation actions the Company will implement. The Audit Committee then monitors the completion of the remediation actions and mitigation efforts.

companyName: OMNICELL, INC.

ticker: OMCL


text: Following these risk assessments, we re-design, implement and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Senior Director, Information Security and Infrastructure who reports to our Acting Chief Executive Officer and Chief Financial Officer to manage the risk assessment and mitigation process.

companyName: Lite Strategy, Inc.

ticker: LITS


text: Our CISO or other business leaders provide quarterly updates to the audit committee regarding our company's cybersecurity risks and activities. These updates include any relevant recent cybersecurity incidents and related mitigation and remediation efforts, cybersecurity systems testing, status updates on Security and Privacy team efforts, and the like. Our audit committee provides updates to the board of directors on material cybersecurity risks and activities.

companyName: Lyft, Inc.

ticker: LYFT


text: Our Chief Information Officer ("CIO") is directly responsible for the implementation of our cybersecurity risk management program, and our Senior Director of Information Security reports directly to the CIO. Our CIO is additionally primarily responsible for our overall information security, strategy, policy, security engineering, architecture, operations and cybersecurity threat detection and the management of cybersecurity risk. Our CIO has over 30 years of experience in the fields of finance, technology and cybersecurity, including relevant prior senior leadership positions held with Marriott International, where he served as Global Chief Information Officer. The CIO meets with our Chief Executive Officer ("CEO") on a weekly basis and regularly reports to our senior management, as well as directly to our Board of Directors and the Audit Committee, regarding our cybersecurity risk and risk management.

companyName: CRACKER BARREL OLD COUNTRY STORE, INC

ticker: CBRL


text: At MongoDB, cybersecurity risk management is an integral part of our overall information security program, which we review and update at least annually to reflect changes to our organization, business practices, technology and services, and applicable legislation and regulations. Our information security program is designed to align with the National Institute of Standards and Technology Cyber Security Framework and provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third parties. This framework includes steps for assessing the severity of a cybersecurity threat or incident, identifying the source of a cybersecurity threat or incident including whether the cybersecurity threat or incident is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. In addition, our information security team provides ongoing education to and requires mandatory training at least once annually of all employees. To bolster the security of our products and services, we have appropriate technical and organizational measures in place to protect data that our customers upload to MongoDB Atlas, which is certified against ISO 27001:2022, ISO 27017:2015, ISO 27018:2019, ISO 9001:2015, SOC 2 Type II, Payment Card Industry Data Security Standard v.4, and Cloud Security Alliance ("CSA") Security, Trust, Assurance, Information Security Registered Assessors Program and Risk ("STAR") Level 2. We also engage third parties to perform annual audits of our standards-based certifications and we have undergone a Health Insurance Portability and Accountability Act examination validated by a qualified third-party assessor.

companyName: MongoDB, Inc.

ticker: MDB


text: 2. Risk Mitigation: Upon identifying risks, PyraMax Bank's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. This involves deploying advanced security technologies, implementing security best practices, and ensuring compliance with industry standards and regulations.

companyName: 1895 Bancorp of Wisconsin, Inc. /MD/

ticker: BCOW


text: The S&RC's responsibilities include monitoring Unisys' enterprise risk profile and its ongoing and potential exposure to risks of various types and reviewing crisis preparedness; incident response plans; summaries of any incidents or activities; and reports or presentations from management or advisors, including third-party experts, regarding the management of enterprise risk program. The S&RC periodically meets with the CISO and Chief Privacy Officer (CPO) and briefs the full Board of Directors on cybersecurity matters.

companyName: UNISYS CORP

ticker: UIS


text: Role of Management Through our services agreement with Liberty discussed in Item 1 of this 10-K, we have established a cross functional Information Security Steering Committee ("ISSC") with executives from our Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at the corporate level and our subsidiaries.

companyName: Liberty Broadband Corp

ticker: LBRDA


text: Our CISO is responsible for the cybersecurity program which is comprised of Cybersecurity GRC (Governance, Risk & Compliance), Cybersecurity Architecture, Operations & Engineering, and a Cyber Fusion Center that includes Threat Intelligence, Vulnerability Management, & Incident Response. Our CISO has 30 years of experience in the oil and gas industry and has held various leadership and strategic roles across IT, software R&D and marketing.

companyName: Marathon Petroleum Corp

ticker: MPC


text: Annual testing from a business continuity perspective, including annual business impact analysis reviews, annual testing of all critical departments, systems and third parties, and established back-up, replication, and restoration to help ensure continuity of operations.

companyName: National Bank Holdings Corp

ticker: NBHC


text: Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications.

companyName: HUMBL, INC.

ticker: HMBL


text: Cybersecurity Incidents While we have no knowledge that we have experienced a cybersecurity incident that has had or is reasonably likely to have a material adverse impact on our operations or financial results as of the date of this Form 10-K, there can be no assurance that we will not encounter such an incident in the future, notwithstanding the cybersecurity measures and processes we have undertaken. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, remediating or restoring our internal systems or information, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. Cybersecurity threats are expected to continue to be persistent and severe.

companyName: MidWestOne Financial Group, Inc.

ticker: MOFG


text: The Board 's Audit Committee oversees our global cybersecurity risk environment, strategy, and priorities. Our CIO, together with other senior leaders, regularly reviews the Company's global information technology (IT) system with the Committee, including reports on risks from cybersecurity threats and the Company's processes to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. In 2024, this review included the CIO's assessment of our IT and cybersecurity capabilities and continuous improvement plan. Our CIO's report to the Audit Committee is provided annually or, if the circumstances warrant, more frequently. In addition, the Board receives periodic reports from the Audit Committee and our CIO relating to risks from cybersecurity threats.

companyName: ChampionX Corp


text: The Committee of the Board meets quarterly. At each meeting, it receives reports from the Chief Information Security Officer ("CISO").

companyName: JABIL INC

ticker: JBL


text: We maintain both an incident response plan and a crisis management plan (the "Plans") that provide a documented framework for responding to actual or potential system failures, interruptions, or cybersecurity breaches, including timely notification of and escalation to the appropriate Board-approved management committees as discussed further below. The Plans are coordinated through the Business Resiliency Manager and Major Incident Manager, who ultimately report to the CISO and the CIO respectively, and key members of management who are embedded into the Plans by their design. The Plans facilitate coordination across multiple parts of our organization and are evaluated at least annually.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: We rely on information technology and data to operate our business and develop, market and deliver our products and services to our customers. A critical part of our strategy involves focusing on gathering data without collecting, maintaining or using sensitive personal data such as social security numbers, credit card numbers, financial account information or medical records. The Cardlytics platform is designed so that we do not receive or have access to any personal data from our FI partners. We only perform targeted marketing using data that has undergone processing such that it is only linked to anonymized identifiers.

companyName: Cardlytics, Inc.

ticker: CDLX


text: We also require cybersecurity training for relevant employees, focusing on the appropriate protection and security of confidential company and third-party information. The IT team provides regular updates to senior management on various cybersecurity threats, assessments and findings, and the effectiveness of the Company's cyber risk management program. Our Board of Directors through the Audit Committee oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Management reports to our Disclosure Committee and Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Reservoir Media, Inc.

ticker: RSVR


text: While our Board of Directors is ultimately responsible for risk oversight, committees of the Board of Directors assist in fulfilling oversight responsibilities in certain areas of risk. The Audit Committee of the Board of Directors (the "Audit Committee") is responsible for overseeing risks from cybersecurity threats. The Audit Committee receives cybersecurity updates from IT leadership at least twice a year. When meeting with the Audit Committee, the IT leadership team highlights significant accomplishments and issues related to our IT infrastructure, including cybersecurity incidents, risks, industry trends, notable incidents facing other companies, incident preparedness and other developments. The Audit Committee also receives updates regarding progress on initiatives to further align with the five pillars of the NIST CSF. These briefings are designed to provide visibility to the Audit Committee about the identification, assessment, and management of critical risks, audit findings, and management's risk mitigation strategies.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: DFIN's initiatives and internal goals incorporate cybersecurity, including cyber risk requirements and cyber risk analysis. To deliver upon regulatory, client and Company cybersecurity objectives, the Company made investments to support processes, architectures and system operations models which specifically address cyber risk, including but not limited to threat detection and response capabilities, end point detection, incident response partnerships and other services provided by managed security service providers. The Company leverages cybersecurity technologies designed to ensure security of client, employee and business confidential data. Mitigating cybersecurity risk is also a part of DFIN's overall business strategy and is further evidenced by programmatic endeavors such as adopting a Zero Trust Architecture wherein all users, systems, applications and networks are deemed untrusted and must be verified. Separately, part of DFIN's corporate strategy includes maintaining adequate cybersecurity insurance. During the renewal process underwriters evaluate all aspects of DFIN's cybersecurity posture, providing another annual evaluation of the Company's cyber risk management.

companyName: Donnelley Financial Solutions, Inc.

ticker: DFIN


text: The CISO has over 30 years of experience in assessing and managing cyber risks, is responsible for day-to-day management of cybersecurity risks and regularly reports to the Board of Directors through the CWG.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: Risks from Cybersecurity Threats Despite the security measures we have implemented, certain cyber incidents could materially disrupt operational systems; result in loss of trade secrets or other proprietary or competitively sensitive information; compromise personally identifiable information regarding customers or employees; delay our ability to deliver products to customers; and/or jeopardize the security of our facilities. These risks are further described in the risk factors within Item 1A, particularly under the headings "We may be subject to risks relating to our information technology and operational technology systems," "We currently rely on third-party service providers for many of the critical elements of our global information and operational technology infrastructure, and their failure to provide effective support for such infrastructure could increase our cybersecurity risk or otherwise negatively impact our business and financial results," and "Disruptions or breaches of our information systems could adversely affect us."

companyName: Allegion plc

ticker: ALLE


text: Reporting to Board of Directors The Senior Director of IT consistently communicates with the Audit Committee regarding critical cybersecurity risks and incidents, ensuring that the organization's highest governance bodies remain well-informed about our cybersecurity status and potential vulnerabilities. Moreover, matters of significant cybersecurity importance, along with strategic risk management decisions, are promptly escalated to the Board of Directors. This process ensures that the Board maintains thorough oversight and is equipped to offer informed guidance on critical cybersecurity issues.

companyName: SAB Biotherapeutics, Inc.

ticker: SABS


text: While we have not experienced any material cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, as of the date of this Annual Report on Form 10-K, there can be no guarantee that we will not be the subject of future threats or incidents. Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.

companyName: MCCORMICK & CO INC

ticker: MKC