text: Horizon recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: New Horizon Aircraft Ltd.

ticker: HOVR


text: Our team of cybersecurity professionals is led by our Vice President, Infrastructure and Security, who along with other members of the IT team collectively over extensive experience in the cybersecurity space in both the pharmaceutical and non-pharmaceutical sectors, many of whom have obtained professional security certifications. The IT team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. For further information about Management's role in assessing and managing the registrant's material risks from cybersecurity threats, see "Risk Management and Strategy," under this Item 1C.

companyName: IOVANCE BIOTHERAPEUTICS, INC.

ticker: IOVA

secItem: Item 1C


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. The Audit Committee of our Board is responsible for the oversight of risks from cybersecurity threats. The Audit Committee regularly receives an overview from management of our cybersecurity activities. Material cybersecurity threat risks may also be considered during separate Board discussions of important matters such as enterprise risk management, budgeting, and other relevant matters.

companyName: Local Bounti Corporation/DE

ticker: LOCL


text: The Company's Crisis Management Team has relevant expertise and experience to assess and remediate cyber threats. The CIO has over 17 years of experience in information technology and security, and the CISO has 31 years of information technology experience and 11 years of information security experience.

companyName: SONOCO PRODUCTS CO

ticker: SON


text: Risk Management Program As part of the information security program, CX App has a risk management program that continuously engages in the process of identifying, evaluating, and treating risks around the organization's valuable information. It addresses uncertainties around information assets to ensure the desired business outcomes are achieved. CX App performs annual Risk Assessments (RAs) to determine security risks in corporate operations, products, and services, and initiates appropriate remediation.

companyName: CXApp Inc.

ticker: CXAI


text: Our cybersecurity risk management program evaluates the risk associated when selecting third-party service providers. In addition to new vendor onboarding, critical vendors are reviewed annually to ensure we understand their cybersecurity posture, and their responsibility in protecting our assets appropriately.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: Newmont requires third parties that supply IT services, have access to Newmont systems, or manage Newmont data to adhere to established Newmont security policies. Additionally, Newmont requires that such third parties are required to provide detailed information on their established security controls via our third party risk assessment process. The third party risk assessment informs our contracting process. Specific certification may be required of critical third party IT service providers and partners. All third party workers are bound by our Acceptable Technology Use standard which governs appropriate IT systems access and usage.

companyName: NEWMONT Corp /DE/

ticker: NEM


text: O ur VP, IT Global Infrastructure ("ITGI") leads our cybersecurity program through our global information security operations team and also leads our IT Governance, Risk and Compliance and Incident Response functions. Our acting Chief Information Security Officer ("CISO") leads our security operations functions. Our CISO has over 10 years of experience in information technology security obtained in civilian and military roles and our ITGI has over 20 years of experience in information technology and cybersecurity leadership obtained in civilian roles. As part of our cybersecurity program, our CISO and/or our Chief Information and Technology Officer regularly report on cybersecurity matters to our Audit Committee. As of December 31, 2024, our Cybersecurity, Risk and Compliance teams consisted of team members and contractors, many of whom have advanced degrees and cybersecurity-related industry certifications. Under the direction of our ITGI and CISO, we monitor developments that could affect our long-term organizational cybersecurity strategy based on threats globally and to continually enhance our cybersecurity program in response to such developments.

companyName: ZIMMER BIOMET HOLDINGS, INC.

ticker: ZBH


text: We have also created, and tested through incident response drills, the Freshpet Incident Response Plan and Playbook, which together set forth policy-level directives as well as specific guidelines for implementation, that describe our process for responding in the event of certain defined cyber incidents. These protocols (i) define the roles and responsibilities of participants, relationships to other Company policies and procedures, and reporting requirements needed during an incident, (ii) provide a framework by which our Incident Response Team (IRT) shall determine the scope and risk of an incident, respond appropriately to that incident, and inform the Board and others depending upon the nature and severity of the incident, and (iii) reduce the likelihood of a similar incident from reoccurring following identification of such an incident.

companyName: Freshpet, Inc.

ticker: FRPT


text: We are committed to protecting the confidentiality, integrity, and availability of its information systems and the data they contain from cybersecurity threats. We acknowledge that cybersecurity is a dynamic and evolving area of risk that requires ongoing assessment, management, and oversight. As we grow in size and revenue, we intend to work with third party companies to assess, identify, manage, and mitigate material cybersecurity threats, as well as to respond to and recover from cybersecurity incidents, all as necessary.

companyName: AVAX ONE TECHNOLOGY LTD.

ticker: AVX


text: We are a special purpose acquisition company with no business operations. Since our initial public offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk.

companyName: Mountain Lake Acquisition Corp.

ticker: MLAC


text: We assess material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. As our Company grows, we plan to develop a more robust and detailed strategy for cybersecurity in alignment with nationally accepted standards. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: DYNAMIC AEROSPACE SYSTEMS Corp

ticker: BRQL


text: The Company engages third party risk security vendors to identify, mitigate, and remediate cybersecurity risks. A third-party vendor is utilized to perform quarterly scans of all our network endpoints. Any issues identified by the scans are remediated. Annual penetration tests are conducted, which simulate real-world threats, including social engineering threats, to the Company's network and other digital assets. These tests include comprehensive "Dark Web" searches of all domain user emails. We require the annual submission of SOC 1 security certificates from third party vendors that provide systems underlying our financial reporting infrastructure or with access to our financial and sales data.

companyName: Good Times Restaurants Inc.

ticker: GTIM


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas. Despite our efforts we put into maintaining a high level of cybersecurity, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our data or our systems. Third-party risks are included within our ERM assessment program.

companyName: SOUTHWESTERN ENERGY CO


text: Although cybersecurity threats, including those stemming from prior incidents, have not had a significant impact on the Company in the previous fiscal year, and there are no known imminent cybersecurity threats likely to materially affect us, we cannot guarantee that we will remain unaffected in the future. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. Cybersecurity threats are expected to continue to be persistent and severe. For further discussion of such risks, see the section entitled "Risk Factors" in Item 1A of this Form 10-K under the heading "Risks Related to Cybersecurity and Data Privacy."

companyName: NBT BANCORP INC

ticker: NBTB


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training that is provided to our employees and contractors, including those who are involved in incident response; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • assessment of cybersecurity risks posed by third parties, including current and potential collaborators, service providers, suppliers, vendors and other contractual counterparties, in each case, to the extent they have access to our critical systems or information.

companyName: Revolution Medicines, Inc.

ticker: RVMD


text: The Chief Financial Officer periodically provides reports to the audit committee of the board of directors regarding information technology and cybersecurity matters and associated risks. The audit committee is responsible for reviewing and overseeing the Company's risk management process and strategy, including risks from cybersecurity threats. The audit committee periodically reports on cybersecurity risk management to the full board of directors.

companyName: MYOMO, INC.

ticker: MYO


text: Cybersecurity is an area of increasing concern to management of and investors in CPS. While CPS has been ITAR compliant for many years, that in itself does not completely mitigate the risks of a cybersecurity incident. The Company is currently also working towards full compliance with NIST 800 - 171. In working towards this goal, CPS has retained an outside consulting firm to work through this process and help us implement the policies, processes and procedures to further mitigate cybersecurity risks. CPS generally keeps all employee personally identifiable information with its payroll service provider. Each year the provider furnishes us with their SOC report which includes their cybersecurity policies and procedures.

companyName: CPS TECHNOLOGIES CORP/DE/

ticker: CPSH


text: System vulnerability testing performed by our cybersecurity partner who is System of Organization Controls ("SOC") 2 certified and also assists with mitigation. Network assessments are performed at least annually by qualified third-party service providers. Facilitated incident response tabletop exercises conducted at least bi-annually by qualified cybersecurity service providers.

companyName: UFP TECHNOLOGIES INC

ticker: UFPT


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the section referred to as: " If our information technology systems or data, including the personal information and other sensitive information we process, or the information technology systems or data of third parties upon whom we rely, are or were comprised or affected by a cybersecurity incident, we could experience adverse consequences, including, but not limited to, additional costs, loss of revenue, significant liabilities, harm to our brand, material disruption of our operations and other adverse consequences. "

companyName: CS Disco, Inc.

ticker: LAW


text: Our cybersecurity risk management process includes a number of components implemented by internal and external resources, including security monitoring tools, penetration tests and vulnerability assessments, and employee cybersecurity awareness training. We also engage the services of external partners who provide information security services to help maintain our hardware and software, assist with security monitoring on our devices, and help us draft and implement appropriate information security policies.

companyName: Jade Biosciences, Inc.

ticker: JBIO


text: The Board of Directors has formally tasked the Audit Committee with oversight responsibility to review cybersecurity and data privacy risks. The Audit Committee receives regular reports from management about cybersecurity matters. In addition to regular reporting, we have procedures by which potential cybersecurity incidents are reported in a timely manner to the Chief Technology Officer, who then notifies the Chief Operating Officer and General Counsel of cybersecurity incidents and they collectively determine if a specific incident warrants escalation to the Audit Committee and the Board of Directors. Our CTO, who has more than 25 years of information security and cybersecurity experience, manages cybersecurity at the corporate and real estate segments and oversees a team of dedicated cybersecurity personnel employed in our tobacco segment. Our governance procedures are generally designed to identify, assess, mitigate, prevent and, where required, respond to cybersecurity security incidents and threats in a timely manner to minimize the loss or compromise of information and assets and to facilitate incident resolution.

companyName: VECTOR GROUP LTD


text: The Audit & Risk Committee receives regular reports from our CIO concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit & Risk Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: STARZ ENTERTAINMENT CORP /CN/

ticker: STRZ


text: Papa Johns' cybersecurity program includes a defense-in-depth model that utilizes a variety of techniques and tools for protecting against, detecting, responding to and recovering from cybersecurity incidents. Our cybersecurity program is designed to prioritize detection, analysis and response to known and anticipated cyber threats, effective management of cyber risks, and resilience against cybersecurity incidents. Our program leverages industry frameworks, including the Payment Card Industry (PCI) Standards and the Center for Internet Security (CIS) security framework.

companyName: PAPA JOHNS INTERNATIONAL INC

ticker: PZZA


text: In the event of a cybersecurity incident impacting us, our management team will report to the Company's board of directors and provide updates on our management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences.

companyName: Catcha Investment Corp


text: The Cybersecurity Committee assists the Board with its oversight of the Company's cybersecurity risks and our cybersecurity program. The Committee reviews our incident response plan, including escalation protocols, business continuity program plans, program budgets and resources, and our cybersecurity insurance program. The Committee also reviews and discusses the activities of the Council at each of its regularly scheduled meetings. The Committee operates pursuant to a written charter and calendar, each of which are reviewed on an annual basis. The Cybersecurity Committee and the full Board receive quarterly status reports on the cybersecurity program from the CSO, addressing progress and updates on various cybersecurity functions and initiatives including, for example, compliance, assessments, security operations and incident response, business resilience, DDoS attacks, data privacy, technology and asset management, controls, and vulnerability management.

companyName: VERISIGN INC/CA

ticker: VRSN


text: While we and our third-party vendors are regularly subject to cybersecurity attacks and incidents, a s of December 31, 2024 and through the date of this filing, we are not aware of any material cybersecurity incidents that have impacted the Company in the last three years. However, we have been the target of cyber attacks and expect them to continue as cybersecurity threats have been rapidly evolving in sophistication and becoming more prevalent in the industry. We face risks of incidents, whether through cyber attacks or cyber intrusions through the Cloud, the Internet, phishing attempts, ransomware and other forms of malware, computer viruses, email attachments, extortion, and other scams. Although we make efforts to maintain the security and integrity of our information technology systems, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them, are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party vendors, will prevent breakdowns or incidents to our or our third-party vendors' systems that could adversely affect our business. For a discussion of these risks, see "Item 1A—Risk Factors—Information Technology and Cybersecurity Risks—We are dependent on information technology and our systems and infrastructure face certain risks, including from cybersecurity incidents and data leakage."

companyName: BRISTOL MYERS SQUIBB CO

ticker: BMY


text: We have not identified risks from known cybersecurity threats to the business, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. See our risk factor "We are subject to evolving laws, policies, and contractual obligations related to data privacy and security, including cybersecurity, and our actual or perceived failure to comply with such obligations or perceived failure to maintain the integrity of our data could expose us to data loss or litigation, harm our reputation, subject us to significant fines and liability, or otherwise affect our business, prospects, financial condition, and operating results." in Part I, Item 1A. ("Risk Factors") for additional details regarding cybersecurity risks and potential impacts on our business.

companyName: Lifevantage Corp

ticker: LFVN


text: Consistent with our overall risk management governance structure, management is responsible for the day-to-day management of cybersecurity risk while our Board and its Audit and Finance Committee perform an oversight function.

companyName: EASTMAN KODAK CO

ticker: KODK


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, utilizing from time to time, tabletop exercises, business unit assessments, threat modeling, impact analyses, internal audits, external audits, third party vulnerability scans, third party penetration tests, and engagement of third parties to conduct analysis of our information security programs, including an overall assessment utilizing the NIST standards. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to team members or customers and violations of data privacy or security laws.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: We recognize that cybersecurity risks pose a significant threat to our business, customers, and stakeholders, and we have implemented a comprehensive cyber security program to address these risks. We embed security considerations into every aspect of our operations, and our focus encompasses a proactive approach that involves continuous monitoring to swiftly detect and respond to emerging threats to ensure that our stakeholders' information remains secure in the face of evolving cybersecurity challenges. With a foundation grounded in industry best practices, including NIST 800-53, ISO 27001, CIS Top 20, and OWASP Top 10, we prioritize the identification and assessment of risks to create a protective shield around our customers' data. This guides our processes for assessing, identifying, and managing risks related to cybersecurity threats and incidents, as well as ensuring compliance with legal and contractual obligations. Our risk management processes are integrated into our overall business strategy and operations. We use various methods and tools to identify and assess cybersecurity risks across all assets in our technical landscape, such as vulnerability scanning, penetration testing, threat intelligence, risk assessments, and audits from customers.

companyName: Simulations Plus, Inc.

ticker: SLP


text: LII has not experienced any material cybersecurity incidents within the last three years. However, as described in Item 1A, "Risk Factors," any breach of data security could result in a disruption of our services or improper disclosure of personal data or confidential information, which could harm our reputation, require us to expend resources to remedy such a security breach or defend against further attacks or subject us to liability under laws that protect personal data, resulting in increased operating costs or loss of revenue.

companyName: LENNOX INTERNATIONAL INC

ticker: LII


text: Material Impact of Cybersecurity Threats or Incidents We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " Risks Related to our Business, " included as part of our risk factor disclosures at Item 1A of this Annual Report, which disclosures are incorporated by reference herein.

companyName: GLAUKOS Corp

ticker: GKOS


text: The Board of Directors is responsible for overseeing the assessment and management of enterprise-level risks that may impact the Corporation. The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. The boards of directors of the Corporation and the Bank have also established an IT Committee, consisting of at least three independent directors, along with non-voting members from management, including the President and CEO, the Chief Financial Officer, the CITSO, the SVP of Operations, the VP of Information Technology, and the VP of Information Security. The IT Committee assists the boards of directors of the Corporation and CNB Bank in fulfilling their respective governance responsibilities for CNB's information technology and related data security infrastructure under relevant regulatory safety and soundness requirements. Management, including the CITSO, reports on cybersecurity matters regularly to the Board, primarily through the Audit Committee and IT Committee, including an annual report regarding specific risks and mitigation efforts within the Bank and a 3-year cybersecurity threat assessment conducted by third party experts. Management provides benchmarking information and updates on key operational and compliance metrics to the Board of Directors. In addition, cybersecurity training is provided to the full Board of Directors to educate directors on the current cyber threat environment and measures companies can take to mitigate risk and impact of cyber attacks. Several members of the Board of Directors, including the Chairperson of the Audit Committee, also have cybersecurity experience. As described above, management is actively involved in assessing and managing the Bank's material cybersecurity risks. The Corporation's incident response plan provides clear communication protocols, including with respect to members of senior management, which may include the CEO, the CFO, the Board of Directors, the Audit Committee and external legal counsel. In addition, the incident response plan considers communications and reporting to customers, regulators and law enforcement.

companyName: CNB FINANCIAL CORP/PA

ticker: CCNE


text: As of the date of this Report, we are not aware of any risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: Motorsport Games Inc.

ticker: MSGM


text: While we have not identified any material cybersecurity threats or incidents during the last fiscal year, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks Relating to Our IT Systems."

companyName: QuidelOrtho Corp

ticker: QDEL


text: At QVC, the VP Information Security is responsible for day-to-day management and oversight of subsidiary cybersecurity, including assessing, monitoring and mitigating cybersecurity risk. The VP Information Security provides regular reporting to the ISSC and QVC executive management, including quarterly updates on security hot topics, threat intelligence, incidents (if any) and the status of the cybersecurity program to the Chief Executive Officer and the broader executive management team. In addition to real time notification to the ISSC of privacy and security incidents, the ISSC and QVC have a bi-monthly meeting to discuss incidents, incident trends, developments in laws and regulations, and other privacy and cybersecurity hot topics, as applicable.

companyName: QVC Group, Inc.

ticker: QVCGA


text: As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually.

companyName: AMAZON COM INC

ticker: AMZN


text: We have not encountered cybersecurity risks, threats or incidents that have materially affected or are reasonably likely to materially affect the Company, our business strategy, results of operations, or financial condition during the fiscal year ended March 31, 2025.

companyName: QDM International Inc.

ticker: QDMI


text: The board of directors oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations and related risks. They also oversee the response to any significant cybersecurity incidents. Our Chief Financial Officer, who has extensive cybersecurity knowledge and skills, heads the team responsible for implementing and maintaining cybersecurity and data protection practices at the Company and reports directly to the Chief Executive Officer.

companyName: AMERICAN BATTERY TECHNOLOGY Co

ticker: ABAT


text: Despite the Utilities security measures, all of their systems are vulnerable to disability, failures or unauthorized access caused by natural disasters, cybersecurity incidents, security breaches, user error, unintentional defects created by system changes, military or terrorist actions, power or communication failures or similar events.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: AI Policy and Governance Astrana Health recognizes the transformative potential of artificial intelligence ("AI") in healthcare and the corresponding responsibility to implement it ethically and securely. Our AI policy and governance framework emphasizes transparency, fairness, and accountability in the use of AI technologies across our operations. This includes rigorous data privacy safeguards, continuous monitoring to mitigate algorithmic bias, and adherence to industry best practices and regulatory standards. An internal committee comprising experts in technology, legal, compliance, and healthcare operations works to ensure that AI deployments meet ethical and cybersecurity standards. Periodic audits and risk assessments are conducted to evaluate the performance, reliability, and security of AI systems in critical workflows.

companyName: Astrana Health, Inc.

ticker: ASTH


text: The output of each of the foregoing committees are collected and analyzed on a regular basis and our Vice President, Network Engineering, Product Development and Operations briefs the Audit Committee, through quarterly updates as well as on an ad hoc basis between regular updates to the extent needed.

companyName: Gogo Inc.

ticker: GOGO


text: Our Chief Technology Officer, Chief Information & Security Officer and Chief Legal Officer provide periodic reports on our cybersecurity and risk management efforts, including with respect to information security practices, to the Audit Committee of our Board of Directors (the "Audit Committee"), as well as to other members of our executive leadership team, as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Where appropriate, the Audit Committee then periodically reports to the full Board of Directors regarding the Company's assessment of potential risk exposures and the steps management has taken to monitor and control such risks, which includes the Company's cybersecurity program designed to prevent, detect, and rapidly respond to any potential incident. In addition to our scheduled meetings, the Audit Committee and executive leadership team maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on significant developments in cybersecurity to facilitate proactive and responsive oversight. The Audit Committee is apprised of strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement helps drive integration of cybersecurity considerations into our Company's broader strategic objectives.

companyName: Alight, Inc. / Delaware

ticker: ALIT


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Failure to comply with laws and regulations relating to privacy, data protection, and cybersecurity could lead to government enforcement actions, private litigation and adverse publicity".

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, potential products, services, and our broader enterprise IT environment; • a cyber security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, as we believe appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • risk management processes with respect to third party service providers, suppliers, and vendors.

companyName: Immuneering Corp

ticker: IMRX


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. To date, we have not experienced any cyber incidents that have had a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Risk Factors - Risks Related to Our Business and Industry – If our information technology systems or those of third parties upon which we rely, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."

companyName: Brand Engagement Network Inc.

ticker: BNAI


text: Our board of directors, in coordination with the Audit Committee, oversees our risk management program, including the management of risks associated with cybersecurity threats.

companyName: I-ON Digital Corp.

ticker: IONI


text: Patterson, General Counsel and Chief Compliance Officer. Mr. Patterson has over 20 years of experience in legal and risk management at various biotechnology companies. Mr. Patterson has previously served as General Counsel at a large biotechnology company.

companyName: Gamida Cell Ltd.


text: Cyber Risk Management and Strategy As part of our enterprise risk management program, we have implemented and maintain policies and processes to identify and mitigate risks posed by cybersecurity threats. Our policies and processes are based upon the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and we utilize technologies to help identify and manage potential cyber threats. We have also secured cyber-specific insurance coverage as part of our overall insurance portfolio.

companyName: Savara Inc

ticker: SVRA


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted software as a service vendors, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our production server environments (collectively "Information Systems and Data").

companyName: PlayAGS, Inc.


text: The Company has a robust Enterprise Risk Management Program which has identified cyber security as a top enterprise risk. The managing and monitoring of risks are the responsibility of the Company's Risk Committee, which meets quarterly and is chaired by the Chief Financial Officer.

companyName: NSTAR ELECTRIC CO

ticker: NSARO


text: We monitor our websites and online accounts frequently to manage risks associated with cyber-security risks. Our website is monitored by a third party to check if the website or email server is secure. Our webmaster informs us of any issues that may arise in the cyber sector. We are prepared to inform all parties necessary if any breach of cyber-security were to happen. We have never had this problem and so we have never had to inform consultants, auditors, or other third parties.

companyName: Trans American Aquaculture, Inc

ticker: GRPS


text: We face cybersecurity risks as a result of the variety of networks and systems we must defend against cybersecurity attacks; and the level of harm that could occur if we suffer impacts of a material cybersecurity incident. We are committed to robust oversight of these risks and implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. In the year ended December 31, 2023, we did not experience a material "cybersecurity incident" as such term is defined in Item 106(a) of Regulation S-K. However, we have experienced two such material breaches in the past (see Form 10-K for the year ended 2023) and there can be no guarantee that we will not experience such incidents in the future. Such incidents could result in us incurring significant costs related to implementing threat protection measures, and the possibility of such incidents could result in additional costs in defending against litigation, responding to regulatory inquiries or actions, paying damages, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. Further, cybersecurity threats are constantly evolving, increasing the difficulty of successfully defending against them or implementing adequate preventative measures. While we seek to detect and investigate unauthorized attempts and attacks against our network and to prevent their occurrence where practicable, we remain potentially vulnerable to known or unknown threats. In some instances, we may be unaware of a threat or incident or its magnitude and effects for some time. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Item 1A. Risk Factors" of this Annual Report for more information on our cybersecurity risks and product vulnerability risks.

companyName: BION ENVIRONMENTAL TECHNOLOGIES INC

ticker: BNET


text: Park maintains a third-party risk management program that is designed to evaluate, monitor and control risks connected with third-party vendors, particularly those vendors with access to or possession of sensitive information. The third-party risk management program solicits diligence materials from vendors and conducts internal risk assessments for vendors, including with regard to information security policies, practices, testing, and reporting. Diligence and internal risk assessments for vendors include analysis specific to the vendor's transmission and storage of information, encryption practices, security appliances, vulnerability testing, and past security incidents. Vendor contract negotiations involve data protection terms and responsibilities regarding information breach notifications and reporting.

companyName: PARK NATIONAL CORP /OH/

ticker: PRK


text: Our cybersecurity governance program adopted the Center for Internet Security Critical Security Framework as the structure to help detect and mitigate threats through risk-based controls designed to protect Titan Machinery's information, systems, and network.

companyName: Titan Machinery Inc.

ticker: TITN


text: Chief Executive Officer is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Chief Executive Officer, with the assistance from of both our IT department and external consultants, as needed, implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system checks to identify potential vulnerabilities. In the event of a cybersecurity incident, the Chief Executive Officer is well prepared to initiate immediate actions to mitigate the impact and initiate long-term strategies for remediation and prevention of future incidents. Chief Executive Officer regularly communicates with senior management and the Board of Directors on cybersecurity risks and incidents.

companyName: Novo Integrated Sciences, Inc.

ticker: NVOS


text: Our cybersecurity risk management and strategy focus on several areas: • Risk Identification and Reporting: We have implemented a comprehensive, cross-functional approach to assessing, identifying, and managing material cybersecurity threats and incidents. The program includes controls and procedures to properly identify, classify, and escalate certain cybersecurity incidents to provide management visibility and obtain an assessment from management as to the public disclosure and reporting of material incidents in a timely manner. The Information Security and Privacy team's responsibilities include: Conducting privacy impact assessments; Rating cyber risk severity, coordinating remediation, and monitoring cyber risks within our enterprise risk register; Cyber threat intelligence functions, including monitoring cybercrime and geopolitical developments; Supporting mergers and acquisitions activities, including integration of newly acquired businesses; Performing security architecture reviews, both of existing enterprise systems and those of newly acquired organizations;

companyName: Live Nation Entertainment, Inc.

ticker: LYV


text: Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems, including cloud-based platforms and services. For example, third parties are used to conduct assessments, such as vulnerability scans and penetration testing. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and performance monitoring.

companyName: Star Equity Holdings, Inc.

ticker: STRR


text: In addition, Elite maintains processes to help govern the processes put in place by management designed to protect the Company's IT assets, data, and services from threats and vulnerabilities. Elite employs additional key practices within the cybersecurity risk management program including, but not limited to maintenance of an IT assets inventory, identity access management controls including restricted access of privileged accounts, physical security measures at Company facilities, information protection (IPS)/detection systems (IDS) including maintenance of firewalls, network and data traffic monitoring and automated alerting, and critical data backups to reduce cybersecurity risk.

companyName: ELITE PHARMACEUTICALS INC /NV/

ticker: ELTP


text: As an externally managed company, our day - to - day operations are managed by BFIM, under the supervision and with the participation of the Principal Executive Officer and Principal Accounting and Financial Officer. Our business is highly dependent on the communications and information systems of BFIM, its affiliates and third - party service providers. BFIM is an affiliate of ORIX Corporation USA ("ORIX USA"), a diversified financial company and a subsidiary of ORIX Corporation ("ORIX") and participates in and is subject to ORIX USA's cybersecurity program. Accordingly, we rely and BFIM relies on ORIX USA and its cybersecurity risk management program to identify, assess and manage material risks to our business from cybersecurity threats.

companyName: BCTC V ASSIGNOR CORP


text: The Company's current security posture and regulatory compliance efforts are intended to address evolving and changing cyber threats. During the past three years, the Company has not experienced a cybersecurity incident resulting in a material impact to its business strategy, results of operations, or financial condition. The Company has identified the risk that a hostile cyber intrusion could severely impair the Company's operations, lead to disclosure of confidential information, damage the Company's reputation or otherwise have an adverse effect on the Companies' business as disclosed within Item 1A. Risk Factors.

companyName: RGC RESOURCES INC

ticker: RGCO


text: • the use of vulnerability scans and penetration testing; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management, including annual incident training, regular phishing email simulations and tabletop exercises to simulate incident responses; • a robust cybersecurity incident response plan that includes documented procedures for preparing for, detecting, responding to and recovering from cybersecurity incidents, as well as processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Opendoor Technologies Inc.

ticker: OPEN


text: Our management, including our Manager's Chief Compliance Officer and CSC, is authorized to take the appropriate steps deemed necessary to identify, assess, contain, mitigate, and resolve cybersecurity threats including by (a) maintaining (i) an Incident Response Plan in the event of an Incident and (ii) a Cybersecurity Policy which governs information technology security policies, (b) regularly monitoring our systems and user accounts for any suspected Incidents, (c) performing annual audits on certain of our systems, and (d) providing general cybersecurity awareness and data protection training. In addition, depending on the circumstances of an Incident, we may engage third parties such as insurance carriers, outside legal counsel, forensic investigators, crisis communications or public relations firms, investor relations firms and response vendors and we may coordinate with regulators or law enforcement. We also assess third party risks when determining the selection and oversight of applicable third-party service providers.

companyName: Terra Property Trust, Inc.

ticker: TPTA


text: Our information security and engineering functions, led by our Vice President of Operational Engineering, help identify, assess and manage the Company's cybersecurity threats and risks. These teams identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our industry's risk profile using various methods including, for example manual and automated tools (including firewalls and endpoint protection); subscribing to and analyzing reports and services that identify cybersecurity threats; conducting scans of our environment; evaluating threats reported to us and coordinating with law enforcement concerning certain threats; conducting threat assessments of both internal and external threats; conducting vulnerability assessments to identify vulnerabilities; working with third-parties to conduct testing and tabletop exercises; and using external threat intelligence feeds.

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. It receives updates on matters of cybersecurity from senior management during regular quarterly meetings and in the interim, if warranted. This includes existing and new cybersecurity risks, how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: Bridger Aerospace Group Holdings, Inc.

ticker: BAER


text: The Audit Committee is the lead Board committee with oversight of the cybersecurity program and bears the primary responsibility for this aspect of the business. The Audit Committee is comprised of Board members with diverse professional backgrounds, such as accounting/finance, utility security, risk management, and business performance integration. The breadth of experience in this Committee enables it to be the most appropriate lead in oversight of cybersecurity risks and capability.

companyName: YORK WATER CO

ticker: YORW


text: Cybersecurity risk management forms part of our overall risk management framework, which is regularly reviewed by our Chief Transformation Officer ("CTO"), our senior management team and our Board of Directors. We retain an ISO 27001:2013 certification related to our information security management system ("ISMS") that supports the assets, technologies, personnel, and processes used by our corporate IT environment, as well as the satellite command and control, data uplink and downlink pipelines, and ground stations utilized by our radio frequency collection and data products. Cybersecurity incident response procedures are enumerated in internal policies and procedures with remediation plans reflective of the scope and severity of the incident. This remediation typically involves incident analysis, incident isolation and eradication, and post-incident response. In the event a cybersecurity incident is detected, the IT Security Team reports the event to our legal and compliance teams. These Legal and Compliance professionals then advise on any additional notification or reporting requirements.

companyName: Spire Global, Inc.

ticker: SPIR


text: Cybersecurity is a critical priority within, and has been integrated into, our enterprise risk management framework. We have instituted a risk-based, multi-dimensional global cybersecurity program, guided by the framework established by NIST. This program aims to assess, identify, and manage risks from potential threats to our data, systems and networks, as well as those of our primary third-party suppliers. We have deployed a suite of physical, administrative and technological safeguards to protect our information systems, encompassing personal data (associate, consumer, customer and business partner), intellectual property and confidential business information. These protections are designed to maintain the confidentiality, integrity and availability of all information housed within our network infrastructure.

companyName: PVH CORP. /DE/

ticker: PVH


text: The importance of protecting against unauthorized access to or use of customer data that has been entrusted to us as part of the various services provided to our customers; as well as operational disruptions caused by cybersecurity events, is of paramount importance to us. The Bank relies upon a formalized Information/Cybersecurity Program ("ICP") to ensure we are protecting the confidentiality, integrity and availability of confidential information. The ICP is approved by the Board of Directors or a Committee thereof annually, and is designed to identify reasonably foreseeable internal and external threats, assess the likelihood and potential damage these threats could cause, and assess the appropriateness of policies, standards and procedures used to identify and mitigate risk levels to within the documented risk appetite. The ICP has been designed to align with industry best practices, as well as Regulatory guidelines and laws; and leverages both the Secure Control and the National Institute of Standards and Technology Cybersecurity frameworks as its baselines.

companyName: FLAGSTAR BANK, NATIONAL ASSOCIATION

ticker: FLG


text: Rocket Companies aligns its Program to the National Institute of Standards (NIST) Cyber Security framework. The Program is reviewed and updated by regular risk assessments, which identify reasonable and foreseeable internal and external risks. Rocket performs ongoing assessments of its Program to measure both the sufficiency of the safeguards to control risk and the design and operating effectiveness of our security requirements and controls. We implement information security policies throughout our operations, and our enterprise risk management ("ERM") process considers information security risks alongside other company risks as part of our overall risk assessment process.

companyName: Rocket Companies, Inc.

ticker: RKT


text: Our Chief Legal Officer and Chief Compliance Officer is responsible for the management oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us to address cybersecurity risks. Our Chief Legal Officer and Chief Compliance Officer has many years of experience overseeing company-wide legal and compliance risks, including at multiple publicly-traded companies. Our Chief Legal Officer and Chief Compliance Officer is supported by our outside information technology management/cybersecurity consultant and our managed security services provider.

companyName: KALA BIO, Inc.

ticker: KALA


text: Stewart is regularly assessed against the cybersecurity frameworks of the National Institute of Standards and Technology (NIST CSF) and also evaluated for compliance with the SSAE-18 Systems and Organization Controls (SOC) standards of the American Institute of Certified Public Accountants (AICPA).

companyName: STEWART INFORMATION SERVICES CORP

ticker: STC


text: Our Chief Information Security Officer and representatives from the Cybersecurity Committee provide quarterly briefings to the Audit Committee of the Board regarding our company's cybersecurity risks and activities, including but not limited to any recent cybersecurity incidents and related responses, and any cybersecurity systems testing. The Audit Committee provides regular updates to the Board on relevant information regarding cybersecurity. In addition, our Chief Information Security Officer and representatives from the Cybersecurity Committee provide annual briefings to the Board on cybersecurity risks, related mitigation, and other related responses and activities.

companyName: MAXLINEAR, INC

ticker: MXL


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. Our CIO regularly informs our management team of all aspects related to cybersecurity risks and incidents. This is designed to ensure that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained cybersecurity consultants.

companyName: KRATOS DEFENSE & SECURITY SOLUTIONS, INC.

ticker: KTOS


text: Our information security program strives to protect the confidentiality, integrity and availability of information and information systems and is aligned to the Company's business and risk management strategies. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk. Key elements of our cybersecurity risk management program include: • IT risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • Information Security Department responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to a cybersecurity incident; • Cybersecurity Assessment Toolkit (developed by the FFIEC) is assessed annually, tracks program maturity, changes in risk profile, and reviews security controls critical to reduce cybersecurity risk. Results are presented to and approved by the Board; • Ransomware Assessment Toolkit (developed by the Bankers Electronic Crimes Task Force, state bank regulators and the U.S. Secret Service) is assessed biannually to capture any gaps and address any potential control deficiencies; • training and awareness programs for employees that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • a cybersecurity incident response plan that includes procedures for responding to a cybersecurity incident; and • a third-party risk management process for service providers, suppliers, and vendors, including those external service providers we engage in our cybersecurity risk management processes.

companyName: SOUTHSIDE BANCSHARES INC

ticker: SBSI


text: Fortrea will continue to leverage our internal audit department to provide independent reviews and recommendations to enhance Fortrea's ability to manage risks effectively, as well as pursue external certifications. Although unknown cybersecurity risks could materialize, including in connection with the implementation of independent systems following the Spin, we are not aware of any disclosures at this time which would be considered material risks and associated with cybersecurity threats or incidents. Refer to Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K for further discussion of cybersecurity risks.

companyName: Fortrea Holdings Inc.

ticker: FTRE


text: cybersecurity awareness training for our employees, incident response personnel, and management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: NATURAL RESOURCE PARTNERS LP

ticker: NRP


text: Federated Hermes' third-party service providers are a potential source of cybersecurity threats. Among other service provider management efforts, Federated Hermes conducts due diligence on key service providers relating to cybersecurity. Due diligence consists of reviewing several key data points regarding service providers. These include, but are not limited to, the business processes the service provider will provide, the sensitivity of the data they will store, process, transmit or access, and network connectivity with the service provider. Using this criteria, Federated Hermes will categorize the service provider into a tiered structure. The tiering defines the requirements for conducting the initial and ongoing due diligence.

companyName: FEDERATED HERMES, INC.

ticker: FHI


text: The UScellular information security program aligns with the National Institute of Standards and Technology (NIST) cybersecurity framework. Risk assessments are conducted periodically leveraging this standard and are integrated into the UScellular Enterprise Risk Management (ERM) program. The assessment results are used to drive continuous improvement in the UScellular cybersecurity control environment, as well as to manage potential data security risks of third-party service providers. UScellular assesses the threat and vulnerability landscape using various commercial, government, vendor and publicly available information sources and tools. UScellular manages these evolving risks through ongoing investments in the security program including active monitoring of the internal data environment and the environments of third-party service providers who manage sensitive data. In addition, UScellular Information Technology leaders conduct regular cyber incident simulations to ensure preparedness in the event of a cyber-attack. UScellular leverages external parties to perform independent assessments and tests of security controls in the environment.

companyName: ARRAY DIGITAL INFRASTRUCTURE, INC.

ticker: AD


text: The IT Committee has direct oversight responsibilities for our cybersecurity program and receives reports on the Company's cybersecurity program from our CIO at each of our regular meetings which occur quarterly. These reports include analyses of any recent cybersecurity threats and incidents at the Company and across the industry, along with a review of internal controls, risk mitigation strategies and third-party service providers. At least annually, the Board of Directors receives reports on the Company's cybersecurity program and a briefing of recent developments from the CIO. Our senior executive management team is actively engaged in the oversight of our cybersecurity program and its future strategy.

companyName: Prime Meridian Holding Co

ticker: PMHG


text: We have dedicated privacy and cybersecurity officers and committees with established processes to assess, identify, manage and investigate all potential privacy and cybersecurity risks and incidents. As a medical device manufacturer with a global presence, we are compliant with privacy laws and regulations in all jurisdictions where we conduct business. In the U.S., the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH" and collectively "HIPAA") provides data privacy and security provisions for safeguarding medical information. Additionally, states in the U.S. are enacting local privacy laws (e.g., California). In the EU, the General Data Protection Regulation ("GDPR") harmonizes data privacy laws and rules on the processing of personal data, including patient and employee data, across the EU. The GDPR has a number of strict data protection and security requirements for companies processing data of EU residents, including when such data is transferred outside of the EU. Additionally, we need to comply with analogous privacy laws in other jurisdictions in which we operate, such as the Israeli Privacy Protection Law, the Asia Pacific Economic Cooperation Privacy Framework, and Japan's Act on the Protection of Personal Information. Our policies and procedures are all designed to ensure compliance with these obligations.

companyName: NovoCure Ltd

ticker: NVCR


text: We have implemented a number of measures to enhance the security and resiliency of our information and data systems. These measures include, but are not limited to: (i) user access control management; (ii) intrusion detection and prevention systems; (iii) information security continuity measures, including redundant systems and information backups; (iv) system segmentation; (v) encryption of critical information and data; (vi) event logging; (vii) implementation of an application patching and update cadence; and (viii) incident response planning and least privilege access methodology.

companyName: Research Solutions, Inc.

ticker: RSSS


text: Our Manager engages in the periodic assessment and testing of our Manager's policies, standards, processes and practices that are designed to address the Company's cybersecurity threats and incidents. These efforts include a wide range of activities, including annual penetration and third-party compliance testing and ongoing internal testing and creation and modification of policies and procedures. The results of the annual assessments are reported to the Audit Committee and the Board, and our Manager adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and ongoing testing.

companyName: NexPoint Real Estate Finance, Inc.

ticker: NREF


text: Should a cybersecurity incident be escalated to the ISC, the ISC notifies the Chief Legal Counsel in his capacity as chair of the ERC. In the event of a material cybersecurity incident, the Chief Legal Counsel, as chair of the ERC, would inform the Board of Directors or the executive committee thereof.

companyName: CRA INTERNATIONAL, INC.

ticker: CRAI


text: Our cybersecurity risk management program includes: • policies, process, and tools designed to identify, assess, and mitigate cyber risks across all aspects of our operations; • a cybersecurity team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, monitor, or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees and contractors; and • a Cybersecurity Incident Response Plan that includes procedures for responding to cybersecurity incidents.

companyName: FOX FACTORY HOLDING CORP

ticker: FOXF


text: Board of Directors and Committee Oversight Our Board of Directors is responsible for understanding the issues and risks that are central to our business, including cybersecurity matters. In general, our Board of Directors and senior management team coordinate to oversee our guidelines and policies with respect to risk assessment and risk management and the Audit Committee of our Board of Directors (the "Audit Committee") discusses our financial and operational risk exposures, and the steps management has taken to monitor and control such exposures. In this context, the Audit Committee would be informed of a material cybersecurity incident that could impact our financial statements.

companyName: Greenbacker Renewable Energy Co LLC


text: Our Chief Financial Officer is responsible for hiring appropriate consultants, helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our Chief Financial Officer, with support from our Chief Information Consultant, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Eledon Pharmaceuticals, Inc.

ticker: ELDN


text: Company's management team is responsible for the oversight and administration of cybersecurity protocols. Our management team relies on our third-party providers to administer cybersecurity assessments to identify, manage, mitigate, and respond to cybersecurity threats.

companyName: INTERGROUP CORP

ticker: INTG


text: In the event of any significant cyber security incident involving FET or its subsidiaries, FirstEnergy's Cyber Security Incident Response Plan provides for a severity determination by the cyber security incident response team based on factors such as the number of assets affected, the likelihood of inappropriate data exposure, operational impact, reliability impact, and regulatory impact. Dependent upon the severity of an incident, it is FirstEnergy's practice to escalate the incident to the FE Senior Vice President, Shared Services, FE Chief Risk Officer, and the FE and FET senior leadership teams, including the FE Chief Legal Officer, FE and FET principal financial officers, and the FE and FET principal executive officers. Such members of management then determine whether, based on various factors, the incident requires immediate escalation to the FET Board, FE Audit Committee and FE Operations and Safety Committee, or the full FE Board.

companyName: FirstEnergy Transmission, LLC


text: We have established processes, procedures, and controls to identify, manage, assess, and mitigate material risks from cybersecurity threats which are designed to help protect our information assets and operations from internal and external cyber threats by understanding and seeking to manage risk while ensuring business resiliency, protecting employee and customer information from unauthorized access or attack, and securing our networks, systems, devices, products, and services, or our Cybersecurity Risk Mitigation Practices. We conduct tests on our systems and incident simulations to help discover potential vulnerabilities and ensure the effectiveness of our Cybersecurity Risk Mitigation Practices. We engage external parties, including consultants, independent privacy assessors, computer security firms, and risk management and governance experts, to enhance our cybersecurity oversight. We also regularly consult with industry groups on emerging industry trends. In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we have a third-party risk management program designed to help protect against the misuse of information technology by third parties and business partners.

companyName: PC CONNECTION INC

ticker: CNXN


text: We believe we have invested in monitoring practices to reduce cybersecurity risks and continue to monitor our systems on an ongoing basis for compliance with applicable privacy regulations and any current or potential threats. We engage third-party service providers to enhance our risk prevention and mitigation efforts. We have periodically engaged third parties to serve in a consultative and advisory manner to review current and future strategies. We also purchase insurance to help protect us against the risk of cybersecurity breaches.

companyName: ADVANCED DRAINAGE SYSTEMS, INC.

ticker: WMS


text: Our cybersecurity program is led by our CIO, who has over 25 years of experience in information technology. Our CIO leads a credentialed and experienced Information Security team who has primary responsibility for our overall cybersecurity risk management program and who supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Enterprise Risk Leadership Team, including our Chief Operating Officer & General Counsel, and the Chief Financial Officer, is responsible for assessing and managing our material enterprise risks, including risks from cybersecurity threats.

companyName: COOPER COMPANIES, INC.

ticker: COO


text: Integration into Enterprise Risk Management Framework Our cybersecurity risk management program is integrated into our overall Enterprise Risk Management framework, which is described in "MD&A—Risk Management—Overview." Our Enterprise Response Framework establishes the reporting structure and escalation process for managing all enterprise incidents, including cybersecurity-related incidents. The framework defines the relationship and notification steps among the various crisis management Cybersecurity | Cybersecurity Risk Management and Strategy stakeholders, including the Board of Directors, the Management Committee, the President and CEO, other members of the executive leadership team, the crisis manager and crisis management coordinators. See "Cybersecurity Governance—Management Role" for a description of the oversight role of the Corporate Risk & Compliance division, Internal Audit and the management-level Technology Risk Committee and Enterprise Risk Committee relating to cybersecurity risk management.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information and utilize outside contractors to assist us in building and supporting our program.

companyName: CytomX Therapeutics, Inc.

ticker: CTMX


text: Our internal team of cybersecurity and data privacy professionals oversee, among other things, our cybersecurity risk management and mitigation, incident prevention, detection, and remediation. The leadership of these teams is comprised of various professionals with cybersecurity expertise, including our Vice President of Information Security and Disaster Recovery, who reports to our Chief Operating Officer. Our Vice President of Information Security and Disaster Recovery has a bachelor's degree in computer information systems, multiple university certifications in advanced cybersecurity, and over 30 years' experience in cybersecurity and technology roles at various companies. Our executive leadership team, with input from the above teams, is responsible for our overall enterprise risk management system and associated processes, and regularly considers cybersecurity risks in the context of other material risks to the Company. Risk Management Program Components, Training, and Incident Response.

companyName: USANA HEALTH SCIENCES INC

ticker: USNA


text: We require employees with access to information systems, including all corporate employees, to undertake data protection, cybersecurity, privacy and compliance programs at least annually. We maintain a team of dedicated security and compliance professionals who oversee cybersecurity risk management, mitigation, incident prevention, detection, and remediation, which is led by our Chief Information Security Officer. The team has deep cybersecurity experience with an average tenure of over 20 years with expertise in protecting critical assets for top firms in a myriad of different industries.

companyName: Digital Turbine, Inc.

ticker: APPS


text: Our enterprise information security program, which is designed to ensure that our information systems are adequately protected, is based on frameworks established by the National Institute of Standards and Technology and other applicable industry standards. Following the ransomware incident we identified in February 2023, we made certain enhancements to our enterprise information security program, including with respect to privileged access management, security monitoring and response, and application backup and recovery. We consider our enterprise information security program to be a key component of our overall risk management system.

companyName: MKS INC

ticker: MKSI


text: We maintain a cross-functional cyber incident response plan with defined roles, responsibilities, and reporting protocols, which focuses on responding to and recovering from any significant breach as well as mitigating any impact to our business. Generally, when a breach or suspected breach is identified, the information security team would escalate the issue to the Cybersecurity Governance Committee for initial analysis and guidance. The Cybersecurity Governance Committee, in consultation with appropriate subject matter experts, would be responsible for determining whether a particular incident alone or in combination with other factors, triggers any reporting and/or further notification responsibilities. The Cybersecurity Governance Committee would designate the primary manager of a cybersecurity incident, identify the parties who should be informed about the incident, and oversee the processes for containment, eradication, recovery, and resolution of the incident. Depending on the severity and impact of a cybersecurity threat, the audit committee and the board of directors would be notified of an incident and kept informed of the mitigation and remediation efforts.

companyName: Invitation Homes Inc.

ticker: INVH


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including senior management. The Company has identified and designated certain Company employees as members of a cybersecurity incident response team, including the Chief Accounting Officer and the IT Manager. This team helps the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: NETSTREIT Corp.

ticker: NTST


text: The Adviser's Director of Information Technology has served in various roles in information technology and information security for 25 years, including serving as Global Technology Manager at a multi-national publicly traded broker-dealer, and 15 years as the Director of Information Technology at a privately held financial services firm. The Adviser's Director of Information Technology holds an undergraduate degree in biochemistry and has attained numerous information technology certifications over the years including Microsoft Certified Systems Engineer (MCSE) and Cisco Certified network Professional (CCNP). The Adviser's Senior Infrastructure Engineer has over 20 years industry experience, holds an undergraduate degree in radiology, and has completed various Microsoft related information technology certifications. Combined, our Adviser's information technology team has over 50 years of experience covering all major aspects of network architecture and management. In addition to our cybersecurity policies, standards, processes and practices, our Adviser maintains cybersecurity policies, standards, processes and practices that are based on recognized security frameworks such as the National Institute of Standards and Technology cybersecurity framework and the Azure Security Benchmark. Our Adviser deploys technical safeguards that are designed to protect our Adviser's information systems from cybersecurity threats and completes internal and external assessments to identify potential cybersecurity threats and vulnerabilities and to identify and oversee cybersecurity risks presented by third parties. The Adviser's Director of Information Technology, in coordination with relevant personnel of the Adviser, works to conceive, implement, and monitor the effectiveness of a program designed to protect their information systems from cybersecurity threats and to promptly respond to any security incidents.

companyName: VINEBROOK HOMES TRUST, INC.


text: Our cybersecurity risk management program is integrated into our overall risk management framework. We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: AFFILIATED MANAGERS GROUP, INC.

ticker: AMG


text: The Company has a formal process in place for identifying, handling and disclosing of material cybersecurity incidents. The Company's Security Oversight Committee ("SOC") includes our Chief Financial Officer, General Counsel, Vice President of Information Security, and representatives from our Internal Audit, Legal, Compliance and Information Systems departments. The purpose of the SOC is to develop and review the Information Security policies, standards and guidelines for the Company that manage Cyber Risk. Furthermore, the Company's Code of Ethics and Conduct explicitly prohibits officers, directors, team members, or other insiders who are subject to the Code from transacting in the Company's stock during a time when such individuals have knowledge of any material undisclosed cybersecurity incident or breach.

companyName: PROASSURANCE CORP

ticker: PRA


text: We have also established a process whereby potentially material cybersecurity incidents are escalated to a Cybersecurity Disclosure Committee ("CDC") consisting of our CEO, CFO, Vice President and General Counsel, Vice President of IT and Corporate Controller. The CDC is tasked with evaluating whether such incidents have material impact on the Company, and thus require disclosure, as well as any other actions that may be appropriate in response to the incident. The CDC promptly notifies the Audit Committee if it determines that an incident is likely to have a material impact on the Company and updates the Audit Committee on a quarterly basis of any incidents that it has evaluated and determined were not material.

companyName: ONTO INNOVATION INC.

ticker: ONTO


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee. Our executive management team informs our Audit Committee on cybersecurity risks on a regular basis, at least once per year.

companyName: Birdie Win Corp

ticker: BRWC


text: While we believe our cybersecurity program is appropriate for managing constantly evolving cybersecurity risks, no program can fully protect against all possible adverse events. For additional information on these risks and potential consequences if the measures we are taking prove to be insufficient or if our proprietary data is otherwise not protected, see Item 1A. "Risk Factors" in this report.

companyName: EMCORE CORP


text: Assessing and managing third-party and vendor cybersecurity risk, including contractual security requirements and periodic reviews; and cybersecurity risk considerations into our enterprise risk management processes.

companyName: INTERGROUP CORP


text: We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats. Our efforts are designed to maintain the confidentiality, integrity, and availability of our information and operational technology systems and the data stored on those systems. The program includes: • periodic risk assessments to identify and assess cybersecurity risks and vulnerabilities in our information technology systems; • security event monitoring, management, and incident response; • third party engagements to perform periodic penetration testing and reviews of program maturity based on the National Institute of Standards and Technology ("NIST") cybersecurity framework; • reviews by our internal audit team of the effectiveness of information technology-related internal controls; • cybersecurity risk assessments of our third-party vendors; and • employee training, including regular phishing simulations. The program is continually adapting to the evolving threat landscape and technology developments.

companyName: KIMBERLY CLARK CORP

ticker: KMB


text: The company's corporate IT security team leads the company-wide cybersecurity strategy and advocates to protect the company systems, its employees and customers against cybersecurity risks. Through annual internal and external audits, we maintain an ISO/IEC 27001:2013 certification for the management of our cybersecurity program consisting of the following areas: • cybersecurity program management and governance including risk management; • cybersecurity operations including security operation centers; • product security; • security investigations; • cybersecurity architecture and engineering; and • security awareness and training.

companyName: THERMO FISHER SCIENTIFIC INC.

ticker: TMO


text: Although we have experienced cybersecurity incidents in the past, as of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm or damage to our Company, loss of intellectual property rights, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "We rely significantly on the use of information technology, as well as those of our third-party service providers. Any significant failure, inadequacy, interruption or data security incident of our information technology systems, or those of our third-party service providers, could disrupt our business operations, which could have a material adverse effect on our business, prospects, results of operations, financial condition and/ or cash flows." under Item 1A. Risk Factors.

companyName: KinderCare Learning Companies, Inc.

ticker: KLC


text: During the fiscal year ended December 31, 2023, the Company did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or that are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition other than the risks described in Item 1A. "Risk Factors".

companyName: CAMDEN NATIONAL CORP

ticker: CAC


text: We have a dedicated team of cybersecurity specialists, led by our Chief Information Security Officer (CISO), who works in coordination with our senior management and leaders at each of our brands to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Our CISO has served in various roles in information technology and information security, as an IT auditor and an IT security executive, for over 38 years as of December 31, 2024, and has both the CISA and CRP designation. We also use a Managed Security Service Provider (MSSP) to provide continuous monitoring of our systems and supplement our internal security team.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: Monitor Cybersecurity Incidents Our IT Manager implements and oversees processes for the regular monitoring of our information systems, which includes having a well-defined incident response plan. In the event of a cybersecurity incident, we can take immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Neuphoria Therapeutics Inc.

ticker: NEUP


text: Both the Information Security Risk Assessment and the FFIEC CAT results are presented to, and approved by, the Audit Committee of the Board of Directors at least annually.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: Our cybersecurity initiatives are led by our CTO and our Director of Security, who holds a Bachelor of Science, Management Information Systems and a Master of Science, Computer and Information Systems Security and Information Assurance. In addition, our CTO and our Director of Security have Computer Hacking Forensics Investigator and Certified Ethical Hacker certifications. Both, under the CTO's leadership, have extensive experience in managing information security, crafting cybersecurity strategies, and spearheading initiatives to counter evolving cyber threats.

companyName: BUILD-A-BEAR WORKSHOP INC

ticker: BBW


text: The audit committee of our board of directors provides oversight over cybersecurity risk and updates the full board of directors periodically regarding such oversight. The audit committee reviews and discusses with management the Company's major risk exposures, including cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents, if any.

companyName: Carisma Therapeutics Inc.

ticker: CARM


text: We have implemented a risk-based approach to our cybersecurity processes, inclusive of risks associated with our use of third-party IT service providers, which considers the sensitivity and volume of the relevant data, the potential effects on third parties and individuals and the needs of our business in determining what risk mitigation, remediation or prevention actions are appropriate.

companyName: Babcock & Wilcox Enterprises, Inc.

ticker: BW


text: We have a Cybersecurity Incident Response Plan (CIRP) that defines roles, responsibilities, and reporting mechanisms, as well as a structured incident response process covering preparation, detection, response, documentation, and post-incident analysis. This plan outlines possible cybersecurity threats and response measures for incidents such as denial-of-service attacks, malicious code attacks, website defacement, data corruption, and data leakage. In addition, we maintain a Business Continuity Plan (BCP) in accordance with ISO 27001 to ensure operational resilience, including detailed continuity procedures, system restoration timeframes, and recovery strategies for various scenarios.

companyName: Ondas Inc.

ticker: ONDS


text: We view cybersecurity as a shared responsibility throughout the Company. At a management level, we have performed tabletop exercises incorporating external resources, advisors and relevant members of the Board as needed. The Company requires all employees to participate in an annual cybersecurity training reviewed by the information security function, and management regularly communicates with employees about potential cybersecurity risks and methods for reporting incidents. The Company has adopted and maintains an Incident Response Plan, which provides for various methods of reporting and escalation of incidents, activation of an incident response team consisting of relevant cross-functional leaders (e.g., legal, information security, operations), assessment of the severity of incidents, processes for investigating and remediating incidents and compliance with related legal and regulatory obligations, among other matters. The Incident Response Plan provides for the involvement of the Company's Disclosure Review Committee to assess the materiality of cybersecurity incidents and any disclosure obligations required in respect thereof. Management periodically reviews the Company's cybersecurity risk management strategy and processes - including the Incident Response Plan - to assess their efficacy in light of current and emerging threats.

companyName: FiscalNote Holdings, Inc.

ticker: NOTE


text: We and our third-party service providers, such as CROs, collect, process, transmit, and store sensitive data on our networks and systems, including intellectual property, proprietary or confidential business information, and a variety of personal data.

companyName: iTeos Therapeutics, Inc.


text: Our cybersecurity program is aligned with various frameworks for managing cybersecurity risks, such as the National Institute of Standards and Technology Cyber Security Framework for IT systems and International Electrotechnical Commission 62443 which governs cybersecurity for Industrial Control Systems. This program is integrated into our ERM processes. Our ERM function manages enterprise-wide risk and has established a governance structure in charge of continuous risk management. It has defined risk management processes related specifically to cybersecurity, which include targeted cyber risk reviews, annual cyber risk assessments over our IT and operations, and integration with our information security function. We also have a Cyber and Privacy Risk Committee, led by our CISO, which provides strategic and actionable recommendations on cybersecurity topics, issues, and controls to our executive management team, and a Crisis Management Committee, led by our head of ERM, which manages significant cybersecurity events.

companyName: CONSTELLATION BRANDS, INC.

ticker: STZ


text: Our Information Security Program is led by our CISO and overseen by our TIRC. The program is designed to safeguard the confidentiality, integrity and availability of information assets by monitoring the cyber threat landscape, internal threats and technological changes and through the development of controls to mitigate risk to the organization and our customers.

companyName: Discover Financial Services


text: We also have an executive cybersecurity and information technology steering committee comprised of our Chief Executive Officer, CIO, and other members of our executive leadership team, whose primary responsibilities include: • approving containment and remediation procedures for escalated cyber incidents; • activating, when appropriate, a crisis management team response; and • approving certain incident response measures.

companyName: HUNTINGTON INGALLS INDUSTRIES, INC.

ticker: HII


text: The Company has adopted an Incident Response Plan (the "IRP") that provides a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company.

companyName: WOLVERINE WORLD WIDE INC /DE/

ticker: WWW


text: In the event of any significant cyber security incident, FirstEnergy's Cyber Security Incident Response Plan provides for a severity determination by a cyber security incident response team based on factors such as the number of assets affected, the likelihood of inappropriate data exposure, operational impact, reliability impact, and regulatory impact. Dependent upon the severity of an incident, it is FirstEnergy's practice to escalate the incident to the Chief Information Officer, Chief Risk Officer, and the FE senior leadership team, including the Chief Legal Officer, Chief Financial Officer, and Chief Executive Officer. Such members of management then determine whether, based on various factors, the incident requires immediate escalation to the Audit and Operations and Safety Committees or full FE Board.

companyName: FIRSTENERGY CORP

ticker: FE


text: We utilize various processes and tools to assess, identify, and manage risks from cybersecurity threats. In the development of our products and features, our security teams work with our engineering and product teams to identify, assess, and agree upon mitigation or remediation measures with respect to product development. On an ongoing basis, we encourage an environment of openness in which our engineering and product teams, led by our security teams, proactively identify, manage and discuss actual or perceived cybersecurity risks. These teams also use automated and manual processes to identify and track risks from cybersecurity threats. The identified risks are triaged, prioritized for remediation, and reported by the security teams to various levels of our senior management, as appropriate. We also deploy technical safeguards that are designed to protect our platform and systems from cybersecurity threats, including firewalls, intrusion prevention, and detection systems. We have established an incident response plan that addresses our response to cybersecurity incidents, and we require periodic training for our employees on cybersecurity threats. In addition, we maintain cybersecurity insurance, however, the costs related to cybersecurity threats or disruptions may not be fully insured.

companyName: Datadog, Inc.

ticker: DDOG


text: Cybersecurity risks are part of the broader ERM process overseen by our Board of Directors. ERM risk assessment results are presented annually to the Board of Directors, and status updates are delivered quarterly to the Audit Committee.

companyName: Mid-America Apartments, L.P.


text: The Chief Technology Officer ("CTO") leads management's assessment and management of cybersecurity risks. The Company's Head of Information Security leads the information security team, which is responsible for managing day-to-day cybersecurity risks and implementing and maintaining the Company's cybersecurity strategy. The Head of Information Security reports to and regularly briefs the CTO on cybersecurity matters, including results of vulnerability testing and remediation, cyber incident responses, and progress on cybersecurity infrastructure initiatives. The CTO and Head of Information Security update the Audit Committee about cybersecurity risks and any investigation of a material cybersecurity incident.

companyName: IMAX CORP

ticker: IMAX


text: Protection, Endpoint Management and Threat Intelligence protocols have been implemented to safeguard sensitive data. They include the protection of data both at rest and during transmission.

companyName: Guardion Health Sciences, Inc.


text: We promote a company-wide culture of cybersecurity risk management to ensure that cybersecurity risk considerations are an integral part of decision-making at every level. We have implemented cyber defenses to safeguard our information systems and protect the confidentiality, integrity and availability of our data. We continuously evaluate and refine our cybersecurity risk management practices to ensure they align with our business objectives and operational needs. Our cybersecurity risk management program is comprehensive in scope and covers the systems supporting our business.

companyName: Armlogi Holding Corp.

ticker: BTOC


text: Management plays a role in assessing and managing our material risks from cybersecurity threats through membership on our cybersecurity team, as well as by making final materiality determinations and disclosures and other compliance decisions, as reflected in the HighPeak Energy IRP.

companyName: HighPeak Energy, Inc.

ticker: HPK


text: Our Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee, is responsible for the oversight of risks from cybersecurity threats. At least annually, the Audit Committee receives an overview from management of our cybersecurity strategy, programs, and risk mitigation activities, as well as other developments and action items related to cybersecurity. In its meetings, the Audit Committee has the opportunity to discuss these matters with the head of our Information Technology department and other members of executive management. Members of the Board are also encouraged to engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: Varex Imaging Corp

ticker: VREX