text: Leaders in Management The Company's IT strategy and implementation is overseen by a dedicated Chief Information Officer with over 20 years of experience in the field, including previously serving a 17-year tenure, most recently as Vice President of Global IT, with a global technology leader of fiber optic subsystems and components. He holds a Bachelor of Science in Computer Science and Engineering from Andhra University in India and an MBA from the Indian School of Business. In addition, the Company has engaged a Chief Information Security Officer ("CISO") that has built and managed world-class information security programs and technology teams for industry leading global companies. She has deep experience securing healthcare-focused companies in both the provider and supplier space. She holds a Bachelor of Science from the University of Redlands and an MBA from Notre Dame De Namur University along with holding certified information systems security professional ("CISSP") and certified information security manager ("CISM") certifications.

companyName: OMNICELL, INC.

ticker: OMCL


text: The Company employs an information security and training program for our employees, including mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. The Company engages external third parties to advise on emerging threats to stay current and strengthen our security capabilities. The Company performs penetration testing and other exercises within internal and external networks for potential vulnerabilities.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO

secItem: Item 1C


text: We manage cyber risk on a daily basis, as we face a multitude of threats ranging from ransomware and phishing attacks, business email compromise, and a wide array of other cyber-criminal tactics aimed at impacting our operations and compromising our sensitive information. Our customers, suppliers, subcontractors and partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. Accordingly, we have invested in resources (people, process, and technology) aimed at identifying, assessing, and responding to cyber threats.

companyName: INSULET CORP

ticker: PODD


text: UScellular's Information Technology Security leaders are responsible for assessing and managing cybersecurity risks. Management has a depth of cybersecurity experience focused on increasing the organization's resilience to security threats and stays current on new developments through continuing education and monitoring of the cybersecurity landscape. The UScellular environment is monitored for potential security threats and security events are investigated and acted on to minimize potential risk to the environment.

companyName: ARRAY DIGITAL INFRASTRUCTURE, INC.

ticker: AD


text: Our cybersecurity risk management program is designed to assess, identify, and manage material risks from potential unauthorized breaches of or access to our electronic information systems, and the information we store on our systems. Our program includes a wide variety of mechanisms, controls, technologies, methods, systems and other processes as further described below that are designed to prevent, detect, or mitigate unauthorized access, data loss, theft, misuse or other security incidents and vulnerabilities affecting our systems and the information we store on our systems. The information we store includes confidential, proprietary, business, and personal information of ours, our customers, our employees and other third parties that we collect, process, store and transmit as part of our business. Our program is aligned with the National Institute for Standards and Technology Risk Management Framework (NIST RMF), other industry-recognized standards and our contractual requirements. We also leverage government partnerships, industry and government associations, third-party benchmarking, the results from regular internal and third-party audits, threat intelligence feeds and other similar resources to inform and guide our cybersecurity processes and resource allocation. Additionally, we use processes and third-party technologies to oversee and minimize impact to our data, including two-factor authentication, encryption, Company secured email and dedicated cybersecurity support personnel.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. Our Head of Information Technology, and the Cybersecurity Committee, is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. The current Head of Information Technology has over 20 years of experience in information security and possesses the education, skills, experience, and industry certifications expected by our company of an individual assigned to these duties. The Head of Information Technology provides periodic updates on our information technology environment risk, which is inclusive of our cybersecurity risk profile, to the Board of Directors, which includes the Audit Committee members.

companyName: Biomea Fusion, Inc.

ticker: BMEA


text: We believe our information technology team to be well-qualified in this area. These qualifications include collective decades of professional experience in the field, in both private enterprise and government, and relevant training and certifications, such as Certified Information Systems Security Professional (CISSP) certification, ISO 27001 certification, and other technical cybersecurity certifications from ISC2, the SANs Institute and OffSec as well as recent participation in IT and cybersecurity programs organized by leading educational institutions with expertise in the field.

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: We utilize data analytics to detect anomalies and search for cyber threats. We engage third-party consultants or other advisors to assist in assessing, identifying and/or managing cybersecurity threats.

companyName: NORTECH SYSTEMS INC

ticker: NSYS


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management team, including our director, information technology and our IT security specialist, with input from outside parties specializing in cybersecurity risk. Our director, information technology is responsible for communicating key priorities to relevant personnel and helping to integrate cybersecurity risk considerations into our overall risk management strategy. Our IT security specialist is responsible for reviewing cybersecurity processes and security assessments, preparing security-related reports, and helping prepare for cybersecurity incidents. Our senior IT personnel have expertise in general IT matters and are pursuing certifications in cybersecurity. We utilize third parties for specialized IT matters, including cybersecurity, to augment the expertise of our internal IT personnel.

companyName: LUMOS PHARMA, INC.


text: The underlying controls of the cyber risk management program that the Partnership currently has in place are based on recognized best practices and standards for cybersecurity and information technology, including the International Organization Standardization ("ISO") 27001 Information Security Management System Requirements.

companyName: GPB Holdings II, LP


text: Mr. Fabbri, in coordination with the Board, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. Mr. Fabbri and Ms. Garrison monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Board and applicable regulatory authorities when appropriate.

companyName: Farmland Partners Inc.

ticker: FPI


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected our business strategy, results of operations or financial condition or are reasonably likely to have such a material effect. While we have implemented a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information regarding risks relating to privacy and cybersecurity, see "Item 1A—Risk Factors."

companyName: PLUS THERAPEUTICS, INC.

ticker: PSTV


text: Our objective for managing cybersecurity risk is to avoid or minimize the impact of external threat events or other efforts to penetrate, disrupt or misuse Peapack Private systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage information from certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. The Bank's Information Security Officer and Chief Information Officer, who reports directly to the Chief Operating Officer, along with other key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: As of December 27, 2024, we are not aware of any risks from cybersecurity threats, including from previous cybersecurity incidents, that materially impacted the Company's strategy, operations, or financial condition for the past year. However, we have been the target of previous cyber attacks and anticipate we will continue to face risks of incidents through various types of attacks, including those using sophisticated techniques and evolving technologies such as artificial intelligence. Although we make efforts to maintain the security of our systems and data, we are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party vendors, will prevent breakdowns or incidents to our or our third-party vendors' systems that could adversely affect our business. For further discussion, see the risk factor captioned "Our business depends on the continued effectiveness and availability of our information technology infrastructure, and failures of this infrastructure could harm our operations" included within Item 1A. Risk Factors of this Annual Report.

companyName: Keenova Therapeutics plc


text: IT provider is responsible for asset management, automated patching, monitoring of critical systems, Security information and event management, incident detection and response, mobile device security and remote management of all the business digital assets.

companyName: Pacific Green Technologies Inc.

ticker: PGTK


text: Although we believe risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition during the fiscal year ended December 31, 2024, they may in the future, and we continue to closely monitor risks from cybersecurity threats. As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that have materially affected the Company, including our business strategy, results of operations, or financial condition, in the prior fiscal period. For additional information on the impact of cybersecurity matters on us, see Item 1A, "Risk Factors—We face cybersecurity risks, which could result in a loss of customers, cause disclosure of confidential information, adversely affect our operations, cause reputational damage and create significant legal and financial exposure."

companyName: Bancorp, Inc.

ticker: TBBK


text: Finally, the Company's Disclosure Committee is responsible for assisting the CEO, CFO and Audit Committee to prepare SEC-required disclosures, confirming the Company's disclosure controls and procedures are properly implemented and asserting the complete, accurate, timely and fair presentation of public disclosures. The Disclosure Committee is comprised of the Company's CFO, Chief Accounting Officer, General Counsel, Chief Audit Executive, AVP of IT Infrastructure and Security, and senior members of our external reporting, financial planning and analysis, and tax departments. The Disclosure Committee meets quarterly prior to the issuance of required quarterly SEC filings, and in these meetings relevant cybersecurity risks would be discussed.

companyName: NeueHealth, Inc.

ticker: NEUE


text: Role of Management The Company's Vice President, Chief Information Security Officer and Corporate IT, Giles Tipler, oversees the Company's IT security department and is responsible for assessing and managing cybersecurity risks and for leading the Company's response to cybersecurity incidents. Mr. Tipler has over 25 years of experience in information security, risk management, compliance, and information technology, with significant experience building cybersecurity programs across multiple countries in the Americas, Europe, the Middle East, Africa, and the Asia-Pacific regions. Mr. Tipler played an instrumental role in the development of the Company's Incident Response Plan and reports to the Company's Chief Financial Officer, Mr. Tom Vadaketh. Mr. Tipler is also responsible for providing quarterly updates to the Company's Audit Committee and Board of Directors regarding enterprise level risks, the effectiveness of the Company's cybersecurity program, and any material cybersecurity incidents that may arise.

companyName: ENVIRI Corp

ticker: NVRI


text: Cyber Risk Management and Strategy We rely on digital technology to conduct our business operations and engage with our clients, business partners and employees. The technology that we, our clients, business partners and employees rely upon becomes more complex over time as do threats to our business operations from cyber intrusions, denial of service attacks, manipulation and other cyber misconduct. Information Security is an ongoing process of exercising the due care necessary to protect corporate, client and employee information and systems from unauthorized access, destruction, disclosure, disruption and modification of use.

companyName: ALLIANCEBERNSTEIN HOLDING L.P.

ticker: AB


text: We face cybersecurity threats in the ordinary course of our business and have experienced cybersecurity threats and breach attempts in the past. Such threats and breach attempts have not materially affected our business, strategy, results of operations or financial condition. At any given time, however, we may face known or unknown cybersecurity risks and threats that cannot be fully prevented or mitigated, and we may discover vulnerabilities in our cybersecurity programs. Therefore, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For more information on the cybersecurity risks we face, please refer to "We rely on information, communications and data systems in our operations. Systems and information technology interruptions and/or data security breaches could adversely affect our ability to operate, our operating results, our data security or our reputation." in Item 1A. "Risk Factors."

companyName: MASTEC INC

ticker: MTZ


text: Our risk management program includes focused efforts on identifying, assessing and managing cybersecurity risk, including the following: • A robust information security training program that requires all company employees with access to our networks to participate in regular and mandatory training on how to be aware of, and help defend against, cyber risks, combined with periodic testing to measure the efficacy of our training efforts. • Alignment of our program with the National Institute of Standards and Technology Cybersecurity Framework to identify, protect, detect, respond and recover from cyberattacks. • Real-time and robust testing of our systems to assess our vulnerability to cyber risk, which includes targeted penetration testing, tabletop incident response exercises, disaster recovery, periodic audits of our systems by outside industry experts and continuous vulnerability scanning. • Engaging external cybersecurity experts in incident response development and management. • Business continuity plans and critical recovery backup systems. • Maturity assessment and roadmap to sustain/improve security posture based on risk profile.

companyName: BlueLinx Holdings Inc.

ticker: BXC


text: We have previously been the target of cybersecurity attacks and expect such attempts to continue, potentially with more frequency or sophistication. Although no cybersecurity incident during the year ended December 31, 2024, resulted in an interruption of our operations, known losses of critical data, nor a material impact on the firm's strategy, financial condition or results of operations. The scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors–Technology Risks" for more information on how a material cybersecurity incident may impact us.

companyName: PRICE T ROWE GROUP INC

ticker: TROW


text: The Company's approach to managing cybersecurity risks is shaped by insights from the FFIEC CAT, a tool designed for assessing and improving cybersecurity practices. This tool undergoes a thorough examination by an independent third-party on an annual basis to ensure an unbiased and comprehensive evaluation. In its most recent assessment in 2023, the FFIEC CAT identified that the Company is operating at an acceptable level of cyber maturity. This means the Company is effectively handling the inherent risks it faces in five critical areas: cyber risk management and oversight, collaboration on threat intelligence, implementation of cybersecurity controls, management of external dependencies, and resilience in handling cyber incidents.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information on cybersecurity risks, see Item 1A. Risk Factors—"Our business and operations would suffer in the event of computer system failures, cyberattacks or a deficiency in our cybersecurity or a natural disaster."

companyName: Acumen Pharmaceuticals, Inc.

ticker: ABOS


text: The CTO and the Risk and Cybersecurity Committee monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of the Company's incident response plans, which include escalation to the CTO and the Risk and Cybersecurity Committee, as appropriate. As discussed above, the CTO reports out to the Risk and Cybersecurity Committee about cybersecurity threat risks, among other cybersecurity related matters, at least quarterly.

companyName: Usio, Inc.

ticker: USIO


text: The Company's cybersecurity strategy is based on recognized best practices, standards, and frameworks for cybersecurity and information technology, including the Center for Information Security ("CIS") Controls and National Institute of Standards and Technology ("NIST"). The strategy focuses on implementing technologies, controls, and processes to constantly monitor, identify, assess, and manage cybersecurity risks. The Company also has a cybersecurity incident response plan that is designed to provide a framework across all functions for a coordinated identification and response to security incidents.

companyName: GIBRALTAR INDUSTRIES, INC.

ticker: ROCK


text: We also maintain a security awareness program with mandatory semi-annual training content and perform automated e-mail based phishing tests. Results of testing help to inform and provide continuous improvement of our security awareness training materials, approaches and strategies. We routinely communicate with employees about the potential for cybersecurity threats, including the latest adversary trends and social engineering techniques, and how to avoid them, and the best use of our established communications channels.

companyName: KalVista Pharmaceuticals, Inc.

ticker: KALV


text: The Committee and Subcommittee each conduct both regular quarterly and as-needed meetings throughout the year during which members of the IT Department provide updates and report on meaningful cybersecurity risks, threats, incidents and vulnerabilities in accordance with the Committee's and the Subcommittee's respective reporting frameworks, as well as related priorities, mitigation and remediation activities, financial and employee resource levels, regulatory compliance, technology trends and third-party provider risks. To help inform this reporting framework, the IT Department and OFS Advisor maintain incident response plans and other policies and procedures designed to respond to, mitigate and remediate cybersecurity incidents based on the potential impact to our business, IT systems, network or data, including data held by third parties, or to the IT or other critical services provided by third-party vendors and service providers.

companyName: OFS Capital Corp

ticker: OFS


text: Our cybersecurity team provides ongoing information security awareness education, including simulated phishing training, and cybersecurity training for our employees.

companyName: SOMNIGROUP INTERNATIONAL INC.

ticker: SGI


text: The Company's Chief Information Officer and Vice President of IT security and Compliance have significant experience in managing and leading information systems and deploying cybersecurity technologies and have extensive cybersecurity training and knowledge. The Company's Vice President of IT security and Compliance has several industry certifications, including CISSP (Certified Information Security System Professional), CCSP (Certified Cloud Security Professional) and CCSK (Certificate of Cloud Security Knowledge). The Company's Chief Information Officer reports to the Chief Executive Officer, and the Company's Vice President of IT Security and Compliance reports to the Company's Chief Information Officer.

companyName: RCM TECHNOLOGIES, INC.

ticker: RCMT


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board, Audit and Risk Committee, and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity activities into five categories: identify, protect, detect, respond and recover. Our cybersecurity risk management program is part of our overall risk assessment. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation, and investments in a partnership with a third-party vendor whose experts further advise our processes. Our executive team, which includes the VP of IT, reviews enterprise risk management-level cybersecurity risks annually, along with other key risks to the organization. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an IT security policy as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, malware protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.

companyName: HEARTLAND EXPRESS INC

ticker: HTLD


text: Employees outside of our information security team as well as third-party cybersecurity experts have an important role in our cybersecurity defenses. We require employees to participate in annual cybersecurity training and provide them with additional optional training and awareness materials, and regularly engage our employees in phishing exercises, reporting results to the Information Technology Committee. In addition, we regularly engage assessors, consultants, auditors and other third parties in our management of cybersecurity risk. For example, third parties are engaged to conduct evaluations of the maturity and effectiveness of our security program, including testing the design and operational effectiveness of security controls, penetration testing, engaging in independent audits, reviewing our policies and standards, and consulting on best practices to address new challenges. We also receive threat intelligence from government agencies, information sharing and analysis centers, and cybersecurity associations.

companyName: ASSURANT, INC.

ticker: AIZ


text: Company's VP of Information Security is responsible for implementing Information Security Policies on a day-to-day basis along with the Security Team (as defined in the Information Security Policies), which includes the VP of Information Security, the Chief Product Officer, the VP of Data Engineering and Platform Services, and the VP of Technology (Information Technology).

companyName: OptimizeRx Corp

ticker: OPRX


text: The Board of Directors has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Chief Information Security Officer as well as other members of the senior leadership team. The Board also receives periodic updates from management and the Audit Committee on cybersecurity risks.

companyName: Value Exchange International, Inc.

ticker: VEII


text: This approach allows us to benefit from specialized expertise, helping ensure that our cybersecurity strategies and processes are informed by current industry insights. While these collaborations are not mandated, they are encouraged as part of our commitment to maintaining a vigilant and adaptive cybersecurity posture in line with evolving best practices.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH


text: Management plays a role in assessing and managing our material risks from cybersecurity threats through membership on our cybersecurity team, as well as by making final materiality determinations and disclosures and other compliance decisions, as reflected in our IRP.

companyName: MEXCO ENERGY CORP

ticker: MXC


text: Our board of directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, business partners, stockholders, and employees. Our audit committee oversees our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes and practices are fully integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and other applicable industry standards. We seek to address cybersecurity risks through a comprehensive, cross-functional approach that focuses on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Redfin Corp


text: We have committees, response and management teams, and dedicated positions for managing and assessing cybersecurity risk, including a Chief Information Security Officer, a Chief Risk Officer, an Enterprise Risk Management Committee and a dedicated internal information security team. Our Chief Information Security Officer and Chief Risk Officer have extensive experience in the industry. Our Chief Information Security Officer has over 20 years of experience leading information security programs including 12 years of experience in cybersecurity consulting, building efficient and sustainable cybersecurity programs for large, complex and heavily regulated global enterprises. Our Chief Information Security Officer is currently responsible for developing and executing the Company's global security strategy and roadmap along with its long-range plan to meet industry and regional regulatory compliance requirements. We have an information security department with associates who are located around the globe. Our Chief Risk Officer's tenure with Cboe spans 23 years, during which time he has held senior positions in information security and risk management. He is currently responsible for oversight of the Company's risk function including the enterprise risk management, information security, privacy, vendor management, and IT asset management programs.

companyName: Cboe Global Markets, Inc.

ticker: CBOE


text: We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws; other litigation and legal risk; customer attrition; and reputational risks. We have implemented several cybersecurity processes, technologies and controls to aid in our efforts to assess, identify and manage such material risks.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company.

companyName: Affinity Bancshares, Inc.

ticker: AFBI


text: The JFG Board's Risk and Liquidity Oversight Committee oversees JFG's enterprise risk management. Oversight includes reviewing and approving annually JFG's risk management framework and overarching risk appetite statements; reviewing JFG's technology, cybersecurity and privacy risk, legal and regulatory risk, and reputational risk, among other JFG major risk exposures; reviewing the steps management has taken to monitor and control such exposures; and reviewing JFG's capital, liquidity and funding against established risk methodologies. The CISO keeps the JFG Board informed about JFG's security posture and cybersecurity maturity program on a regular basis, providing updates about cybersecurity events, significant incidents, and new initiatives.

companyName: Senior Credit Investments, LLC


text: We engage with third-party service providers in order to maintain awareness of the latest security trends and continuously promote comprehensive cybersecurity practices consistent with industry best practices.

companyName: ADAMS RESOURCES & ENERGY, INC.


text: Our cybersecurity program and related initiatives are managed by the CIO, and our IT team is responsible for enterprise-wide informational technology, coordinating with various functions and business groups to ensure they are following best practices.

companyName: METHODE ELECTRONICS INC

ticker: MEI


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, manage the Company's cybersecurity program. The CCO supervises the Company's oversight function generally and relies on the Adviser's technology team to assist with assessing and managing material risks from cybersecurity threats. The CCO has been responsible for this oversight function as CCO of the Company for more than five years and has worked in the financial services industry for more than 20 years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company.

companyName: PROSPECT CAPITAL CORP

ticker: PSEC


text: A third-party risk management program is in place to address the risks posed by third parties. Through this program, the company evaluates the type of data that is shared with the third party and gains an understanding of the third party's cybersecurity risk profile. Higher risk third parties complete a vendor security self-assessment designed to provide a deeper level of understanding of the third party's risks and controls. Based on the results of this assessment, the entity may be added to our third-party monitoring solution, which provides updates and alerts related to the company's externally facing security posture.

companyName: MARCUS CORP

ticker: MCS


text: Greenlane recognizes that cybersecurity is not solely a technology issue but also a people and process issue. We invest in ongoing employee training and awareness programs to empower our staff to recognize and respond to potential security threats effectively. threats are monitored and acted upon by the Company's information technology security group within the Information Technology team.

companyName: Greenlane Holdings, Inc.

ticker: GNLN


text: Because the techniques used to obtain unauthorized access, disable/degrade service, or sabotage systems change frequently, we have invested and continue to invest in the security and resiliency of our systems and networks to help protect our Information Systems and Data. For a discussion of cybersecurity-related risks that may materially affect us and how they may do so, see the "Risk Factors—Risks Related to Information Technology, Cybersecurity, and Intellectual Property" section of this Report.

companyName: Vivid Seats Inc.

ticker: SEAT


text: The Company is not aware of any material breaches in its cybersecurity operations during the three years ended December 31, 2023. Further, the Company has not identified any cybersecurity threats likely to materially affect the Company's business strategy, results of operations, or financial conditions. For more information, please also refer to our risk factor related to our reliance on third-party service providers under Item 1A, "Risk Factors" of this Annual Report on Form 10-K.

companyName: DYNEX CAPITAL INC

ticker: DX


text: The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents. The Audit Committee provides updates to the board of directors regarding such oversight.

companyName: Jade Biosciences, Inc.

ticker: JBIO


text: The head of our Information Technology department, along with our cybersecurity program manager, are principally responsible for overseeing the risks related to cybersecurity. They are responsible for cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing senior leadership with regular updates on cybersecurity-related matters. These team members combined have more than 40 years of experience in technology and information security risk management across a number of organizations, have multiple relevant technical and governance certifications, and are active in a number of cybersecurity related boards and organization s.

companyName: Varex Imaging Corp

ticker: VREX


text: A cross-functional, enterprise-wide management program operates to evaluate our global cybersecurity program's effectiveness and members of the company's executive committee, through an executive security council, routinely review strategy, policy, program effectiveness, standards enforcement and cyber issue management.

companyName: AUTOMATIC DATA PROCESSING INC

ticker: ADP


text: Oversight of Third-party Risk As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits and ongoing risk assessments. Our cybersecurity risk management extends to risks associated with our use of third-party service providers. For example, we conduct security risk assessments of third-party providers that request or require access to our digital and information assets.

companyName: WOLFSPEED, INC.

ticker: WOLF


text: On February 22, 2024, we disclosed the occurrence of a cybersecurity incident. We continue to investigate the extent of the incident, which we believe was committed by cybercrime threat actors. As of the date of this report, we have not determined the incident is reasonably likely to materially impact our financial condition or results of operations.

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: Our internal steering committee and board of directors oversees our risk management strategies and processes, regarding risk assessment and risk management as they relate to cybersecurity. Our security team is led by our VP of Security who has over 15 years of direct cybersecurity experience that includes incident response, security operations and management. The security and infrastructure teams are responsible for implementing and maintaining cybersecurity and data protection controls and practices for the protection of our robots, customer and company information, systems and data. The VP of Security in coordination with our internal steering committee, whose members include professionals from our executive team, general counsel, product and technology and finance teams, meet quarterly to review our Cybersecurity risk exposure, discuss internal and external threat actors and prioritize remediation strategies. The internal steering committee makes decisions on the avoidance, transference, acceptance and mitigation of our overall cybersecurity risk exposure.

companyName: Serve Robotics Inc. /DE/

ticker: SERV


text: Our information security management team is responsible for assessing and managing material risks from cybersecurity threats. Our Vice President, Head of Security Engineering has more than thirty-five plus years of experience as a security expert and more than twenty-five plus years of experience leading information security teams at renowned technology companies.

companyName: Aurora Innovation, Inc.

ticker: AUR


text: f. Third-Party Risk Management: A process for evaluating and managing the risks associated with our service providers, suppliers, and vendors who access our critical systems and data.

companyName: KALTURA INC

ticker: KLTR


text: At the management level, the Head of IT, who has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at the Company and elsewhere, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices and reports directly to the President and Co-Chief Operating Officer. The Head of IT receives reports on cybersecurity threats from his team and external service providers on an ongoing basis and, in conjunction with management, reviews risk management measures implemented by us to identify and mitigate data protection and cybersecurity risks. The Head of IT works closely with our Legal and Compliance departments to oversee compliance with legal, regulatory and contractual security requirements and to develop reports and presentations to the board of directors and its audit committee. The Head of IT is responsible for providing training to employees in respect of information security.

companyName: StepStone Group Inc.

ticker: STEP


text: Our management team, including our Senior Vice President and Chief Financial Officer, Senior Vice President and General Counsel, Vice President, Information Technology, and Vice President, Internal Audit, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our Program and our Vice President, Information Technology, supervises both our internal information security personnel and our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information technology personnel and external consultants engaged by us, as well as alerts and reports produced by security tools deployed in our information technology environment.

companyName: AMPHENOL CORP /DE/

ticker: APH


text: Our executive leadership team, along with oversight from the Audit Committee of the Board of Directors, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the Company. The Audit Committee oversees the processes by which management assesses the Company's exposure to cybersecurity risks and evaluates the guidelines and policies governing the Company's monitoring, control, and minimization of such risks. Our CTO regularly reports to the Audit Committee regarding cybersecurity matters.

companyName: Churchill Downs Inc

ticker: CHDN


text: We strive to enhance our vendor risk analysis, with a goal of universalizing the use of form cybersecurity questionnaires and/or security addenda where applicable. We consider the results of a security and privacy review of material vendor contracts, as well as our material contracts with business partners. Our goal is to proactively identify and manage potential security risks and vulnerabilities, and to clearly articulate the responsibility – whether shared, divided, flow-down, or otherwise – of Tyler, our acquisition targets, our vendors, and/or our business partners. We expect third parties – including our clients – to report cybersecurity incidents to us so that we can assess the impact of the incident on us.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: We use cybersecurity technologies, products, specialized IT tools and services including cyber threat intelligence and external cyber technology experts to understand, manage, mitigate and continually remediate identified risks. A cybersecurity incident may be detected in a number of ways, including through the following avenues: Security Operations Center (SOC) events, employee reports such as helpdesk incidents, and Cybersecurity tool and service stacks (e.g., vulnerability detection, threat intelligence, anti-virus, and malware detection tools). All cybersecurity risks are logged into the Company's cyber security risk register where they are tracked for remediation. These cybersecurity risks are discussed with management for resolution planning and escalation. We leverage recognized cybersecurity frameworks to drive strategic direction and maturity improvement and engage third party security experts for risk assessments, risk mitigation actions, vulnerability identification, and program enhancements.

companyName: MINERALS TECHNOLOGIES INC

ticker: MTX


text: Monitor Cybersecurity Incidents The Director of Information Technology is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The Director of Information Technology implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Partnership's information technology team is equipped with an incident response plan. This plan includes immediate actions to mitigate and contain the impact and strategies for remediation and prevention of future incidents.

companyName: MARTIN MIDSTREAM PARTNERS L.P.

ticker: MMLP


text: We employ processes for assessing, identifying, and managing material risks from cybersecurity threats that are incorporated into our overall risk management system. These items are designed to help protect our information assets from internal and external threats and protect the integrity and confidentiality of our data. Our system includes procedural and technical safeguards, response plans, and reviews of our policies. We engage various external entities, including consultants, to improve and enhance our cybersecurity oversight. We provide all employees and consultants with cybersecurity and prevention training including timely and relevant topics covering social engineering, phishing, mobile security, and data protection and the need for reporting incidents and suspicious events immediately. With respect to third parties that assist in our cybersecurity oversight, we obtain reports to assess the security of their systems and processes. We engage in ongoing monitoring of all third-party providers to ensure compliance with our cybersecurity standards.

companyName: Meridian Holdings Inc./NV

ticker: MRDN


text: Under the Cybersecurity Program, cybersecurity matters are generally managed by a combination of functional groups that report to CNHI's global leadership team, as appropriate, on matters such as enterprise level cybersecurity initiatives, threat intelligence and product cybersecurity risks and remediations.

companyName: CNH Industrial Capital LLC


text: Managing Material Risks & Integrated Overall Risk Management Our risk management team has evaluated and addressed cybersecurity risks in alignment with our business objectives and operational needs and have integrated them into our overall risk management system.

companyName: Neuphoria Therapeutics Inc.

ticker: NEUP


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance," the AGM Board of Directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. AGM's Chief Information Security Officer ("CISO") and the CISO of Athene, a subsidiary of AGM, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, and also receive support, as appropriate, from our executive officers and other representatives of the Operating Manager and its affiliates. • Collaborative Approach. Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by Apollo management, in consultation with our management and our Board, as applicable, in a timely manner. • Technical Safeguards. Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our Company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.

companyName: Apollo Asset Backed Credit Co LLC


text: Our cybersecurity risk management program aims to identify risks from cybersecurity threats. Our cybersecurity risk management program includes a number of components, including informal self-assessments. Our managed security services provider helps us implement additional security controls, including malware protection and network security tools. We take a risk-based approach to the evaluation of third-party vendors.

companyName: ORAGENICS INC

ticker: OGEN


text: We utilize a risk-based, multi-layered information security framework following the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the Center for Internet Security (CIS) critical security controls. We have adopted and implemented a systematic approach measuring ourselves against this multi-layered framework which we formally review on a quarterly basis (monthly updates as necessary) to identify and mitigate security risks that we believe are commercially reasonable for manufacturing companies of our size and scope and commensurate with the risks we face. In addition, we provide a minimum of two formal program updates each year to the Audit Committee of our Board of Directors.

companyName: Crane Co

ticker: CR


text: We conduct third-party assessments of potential new vendors who process, store or transmit our data, which include a formal security review. This can include the review of documentation related to a vendor's security attestations, such as SOC 2 Type 2 or HITRUST certifications.

companyName: Option Care Health, Inc.

ticker: OPCH


text: We use the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not mean that we meet any particular technical standards, specifications, or requirements of the NIST CSF. We routinely engage consultants and other third parties to assist with our cybersecurity risk management, including third-party penetration tests of our various information technology environments. As part of our current due diligence review and contracting process with third-party vendors that may have access to our data or systems, we perform an information security review of the vendor's program and require such contracts to include certain minimum-security safeguards and notification requirements, where applicable. We also carry cybersecurity insurance with coverage for costs associated with a cybersecurity incident.


text: The annual "Threat Landscape" report published by the European Union Agency for Cybersecurity (ENISA) each October serves as a key strategic intelligence source supporting the hardening and protection of our infrastructure. This report offers a comprehensive perspective on prevalent attack types, mapped across threat vectors and industry domains, accompanied by actionable defense strategies that support effective risk reduction to levels aligned with our organizational tolerance. It allows for the deployment of tailored security also have our own incident response team who is engaged in dealing with security events triggered by our Security Information and Event Management (SIEM) system. Continuous monitoring of our infrastructure — from endpoint devices to virtual clusters — helps detect potential interception of internal communications, preventing the leakage of business-critical data.

companyName: Zedge, Inc.

ticker: ZDGE


text: The Company, like many retailers, relies upon third-party service providers, such as payment processors and network providers, that have faced risks from threat actors and cybercriminal groups that seek to steal payment card data, consumer data, and other sensitive information; disrupt critical information technology systems; and/or demand ransom payments. Although the Company has implemented controls to address these risks, if these risks were to materialize, such as in the event of a cybersecurity incident causing the networks of a third-party payment processor to not be operational, the impact to the Company could be material.

companyName: Bath & Body Works, Inc.

ticker: BBWI


text: Ginkgo's CISO has primary responsibility for assessing and managing Ginkgo's risks from cybersecurity threats. The CISO has over 20 years of pubic- and private-sector experience in information technology and has served as Ginkgo's CISO since 2018. Executive leadership provides oversight and governance through monthly business reviews of the cybersecurity program.

companyName: Ginkgo Bioworks Holdings, Inc.

ticker: DNA


text: We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We nevertheless face ongoing risks from cybersecurity threats that, if realized, could affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item 1A, "Risk Factors" in this Annual Report for additional information regarding potential cybersecurity risks, particularly the risk factor titled "Cyber attacks or other cybersecurity breaches, incidents, or disruptions with respect to our networks, systems, or applications, including unauthorized access to, or disclosure or other processing of, our proprietary, confidential, or sensitive information, including personal information, could disrupt our operations, compromise sensitive information related to our business or personal information processed by us or on our behalf, and expose us to liability, which could harm our reputation and adversely affect our business, financial condition, and results of operations, and as we grow, we may become a more attractive target for cyber attacks."

companyName: SailPoint, Inc.

ticker: SAIL


text: As are other businesses, from time to time, we have experienced efforts by unknown persons, including "bots", to access or breach our information systems, which have been prevented based on measures put in place by the Company. However, there can be no assurance we will be able to protect sensitive data and/or the integrity of the Company's information systems and to defend against such efforts in the future. See Item 1A. "Risk Factors" of this Form 10-K.

companyName: GLOBAL INDUSTRIAL Co

ticker: GIC


text: The audit committee receives periodic reports from the Senior Vice President and General Counsel, Chief Financial Officer, and Vice President, Finance and Controller concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives and has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Regulus Therapeutics Inc.


text: Our Board of Directors has delegated to the Audit Committee the oversight responsibility to review and discuss with management the Company's privacy and data security, including cybersecurity, risk exposures, policies and practices, and the steps management has taken to detect, monitor and control such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The full Board and Audit Committee regularly receive reports and presentations on privacy and data security, which address relevant cybersecurity issues and risks and span a wide range of topics. These reports and presentations are provided by officers with responsibility for privacy and data security, who include our Chief Information Security Officer (CISO), Chief Technology Officer (CTO) and AT&T's Legal team. In addition to regular reports to the Audit Committee, we have protocols by which certain security incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Audit Committee.

companyName: AT&T INC.

ticker: T


text: For additional information regarding how cybersecurity threats could materially affect or are reasonably likely to materially affect our business strategy, results of operations or financial condition, see the risk factors captioned "Our success depends on the security and integrity of the systems and products we offer, and security breaches, including cybersecurity breaches, or other disruptions could compromise our information or the information of our customers and expose us to liability, which would cause our business and reputation to suffer," "We rely on information technology and other systems, and any failures in our systems or errors, defects or disruptions in our products and services could diminish our brand and reputation, subject us to liability and have disrupted and could disrupt our business and adversely impact our results," and "If we, our third-party vendors or service providers, our customers or a company we acquire sustains cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm, regulatory fines or punishment and other negative consequences" under the heading "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K for additional information.

companyName: Light & Wonder, Inc.

ticker: LAWIL


text: Cybersecurity risk was identified as a significant enterprise risk based on the results of our most recent enterprise risk assessment. As a significant enterprise risk, we have worked to identify the underlying drivers of cybersecurity risk, identify the activities in place to manage it and assess its residual risk level. We have developed and implemented comprehensive strategies and processes to assess, identify, manage and mitigate cybersecurity risks, aligning with the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). These processes include: • implementing security event monitoring, incident response processes, access management controls, vulnerability identification and remediation, third-party risk monitoring and user awareness and training; • providing regular security training and awareness content for all associates, with mandatory training for new hires; • maintaining cybersecurity risk insurance to mitigate potential breach-related costs; • engaging consultants to perform periodic external assessments using industry-recognized frameworks like NIST CSF; and • monitoring program maturity through periodic reviews against the Capability Maturity Model Integration framework.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: Despite these measures, the Company cannot guarantee that it will be immune from cybersecurity threats. A successful attack could result in unauthorized access to our systems, data breaches, disruptions to our operations, and financial losses. We are committed to continually evaluating and enhancing our cybersecurity program to mitigate these risks.

companyName: ESCALON MEDICAL CORP

ticker: ESMC


text: We rely on our information technology ("IT") and operational technology ("OT") systems, as well as systems of third-party vendors, to conduct our business. These systems are subject to possible cybersecurity threats. Cyberattacks are becoming more sophisticated, and U.S. government warnings have indicated that infrastructure assets, including pipelines and related infrastructure, may be specifically targeted by certain groups. These attacks include, without limitation, malicious software, ransomware, attempts to gain unauthorized access to data, and other electronic security breaches. Cybersecurity threats, which could increase as a result of geopolitical events, may be perpetrated by state-sponsored groups, "hacktivists," criminal organizations, private individuals and others.

companyName: ENTERPRISE PRODUCTS PARTNERS L.P.

ticker: EPD


text: The Company assesses cybersecurity risks and changes in the cyber environment and adjusts its practices as deemed appropriate. To date, risks from cybersecurity threats have not materially affected, or are not reasonably likely to materially affect, the Company's business strategy, financial condition or results of operations. Refer to Item 1A. Risk Factors in this Annual Report for additional information on risks related to the Company's business, including cybersecurity risks.

companyName: PUBLIX SUPER MARKETS INC


text: Our IDC is notified and activated in the event of a significant cybersecurity incident. The IDC is composed of our CFO, the lead of the SIRT, our General Counsel and other members of our legal and finance teams. In the event of a severe or major cybersecurity incident, the IDC will oversee and coordinate the response, determine materiality of impact and any disclosure requirements in conjunction with legal counsel and will ensure that the Audit Committee and/or the Board are updated and that required disclosures are made in a timely manner.

companyName: NGM BIOPHARMACEUTICALS INC


text: Based on our risk assessment process, we implement and maintain various technical, physical and organizational processes designed to manage and mitigate cybersecurity risks that could affect our Information Technology and Confidential Data, and potential material impacts that may result from such risks. We have implemented measures designed to prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats. The cybersecurity risk management processes we maintain for our Information Technology and Confidential Data, depending on the particular environment and system processes, are designed to address cybersecurity threats; incident response; vulnerability management; business continuity; incident detection and response; internal and external evaluations to assess our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; encryption of data; network security; threat modeling; physical and electronic access; physical security; asset management, tracking and disposal; systems monitoring; vendor risk management; employee security training; penetration testing; cyber insurance; and the maintenance of a dedicated cybersecurity team.

companyName: Enphase Energy, Inc.

ticker: ENPH


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information environment.

companyName: Energy Vault Holdings, Inc.

ticker: NRGV


text: Centuri undertakes vulnerability, attack, and penetration testing via a third-party audit. As part of its general control practices, Centuri performs a review of service organizational controls reports for in-scope vendors to ensure adherence to generally accepted cybersecurity practices. Any reported weaknesses and associated responses are captured and evaluated for impact, and subsequently provided to Centuri leadership for review and response.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Executive Director of IT. This individual has over 25 years of prior work experience in various roles involving: managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, and developing and implementing IT change control policies and procedures, as well as holds several relevant degrees and certifications, including a master's degree in Computer Information Systems, Certified in Security+, and has completed extensive cybersecurity training and testing in: Certified Professional Hacker (EMC White Hat Training), ISC2 Certified Information Systems Security Professional (CISSP) Training, and NIST Framework Development and Deployment.

companyName: DURECT CORP


text: We invest in our cybersecurity defenses and have implemented multiple layers of protection against all known critical threats. We have high levels of compliance to protective controls on our technical estate, robust perimeter defenses, industry-leading filtering and analysis of web and email traffic, widespread multi-factor authentication, continuous training of our employees through educational material or simulation (e.g., phishing) and 24/7 monitoring of the IT estate. We have our own "red team" that is always searching our own environment for signs of vulnerability and have a well-defined Cyber Incident Response Plan ("CIRP") that is performed as a table-top exercise at least annually. A range of dashboards has been designed for use by the cybersecurity management team to monitor the day-to-day performance of the cybersecurity defenses and immediately remediate any sign of concern.

companyName: GXO Logistics, Inc.

ticker: GXO


text: To mitigate these risks, we have implemented technology solutions that are designed to recognize anomalous activity and behavior on systems used by TMC employees, alongside other technical safeguards including: Web Application Firewalls (WAF) Endpoint protection and response Security Event and Incident Management (SIEM) Identity and Access management (IAM)

companyName: TMC the metals Co Inc.

ticker: TMC


text: CPS generally keeps all employee personally identifiable information with its payroll service provider. Each year the provider furnishes us with their Service Organization Controls ("SOC") report which includes their cybersecurity policies and procedures.

companyName: CPS TECHNOLOGIES CORP/DE/

ticker: CPSH


text: The Company operates in a dynamic environment with evolving cybersecurity threats. Our business relies heavily on the secure operation of our technology infrastructure and the protection of user data.

companyName: Mega Matrix Corp.


text: We collaborate with third-party vendors to enhance our processes against unauthorized access to our network, computers, programs, and data. Risk is inherent in risk management and cybersecurity strategy. See "Our operations could be adversely affected if our information technology systems and networks are compromised or targeted by cyberattacks" under Risk Factors in Part I, Item 1A of this report, which we incorporate here by reference.

companyName: VALMONT INDUSTRIES INC

ticker: VMI


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to affect our company, including our business strategy, results of operations or financial condition. We and our third-party partners have frequently been the target of cybersecurity threats and expect them to continue. For an additional description of these cybersecurity risks and potential related impacts on us, see "Risk Factors - Cyberattacks and security vulnerabilities could lead to increased costs, liability claims, unauthorized access to customer data, or harm to our reputation" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Quest Resource Holding Corp

ticker: QRHC


text: The CISO updates the ERC and the Board quarterly. These regular reports include the Sponsor's performance preparing for, preventing, detecting, responding to, and recovering from, cyber incidents. The CISO also promptly informs and updates the ERC and the Board about any information security incidents that may pose a material risk to the Sponsor. The Sponsor contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are reported to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally reported to the ERC and Board.

companyName: Grayscale Bitcoin Mini Trust ETF

ticker: BTC


text: While we do not believe that, as of the date of this Form 10-K, we have experienced a cybersecurity threat or incident, including as a result of any previous cybersecurity incident, that has materially adversely affected our business strategy, results of operations or financial condition, the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security incidents of these types, and we may not be able to implement effective preventive measures against such security incidents in a timely manner. For more information on risks to us from cybersecurity threats, see Part I, "Item 1A—Risk Factors—Risks Related to Information Technology Systems."

companyName: Bumble Inc.

ticker: BMBL


text: Our cybersecurity policies, standards, processes, and practices are robust and comprehensive, aligning with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We have achieved ISO 27001 certification, demonstrating our commitment to security. Our cybersecurity program also includes a detailed control catalog that maps to several other frameworks, providing a broad and thorough approach to managing cyber risks.

companyName: WORLD KINECT CORP

ticker: WKC


text: These reviews are conducted at onboarding and periodically throughout the tenure of the service provider based on risk tier rating of each service provider. We believe these processes enable us to evaluate a third-party service provider's security posture, identify risks that may arise out of our use of the third party's service, and make decisions regarding acceptable levels of risk and risk mitigation.

companyName: First Choice Healthcare Solutions, Inc.

ticker: FCHS


text: We have an Executive Security Steering Council (the "ESC") comprised of members of our executive team, our Chief Information Officer, and CSO. Our CSO, in coordination with the ESC, works collaboratively to implement our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our Security Operations, Security Engineering, and Governance teams communicate with and report to the CSO, enabling the CSO and the ESC to monitor the detection, mitigation, and remediation of cybersecurity incidents. Our CSO has over 27 years of security experience in multiple relevant technology and leadership disciplines, including prior work experience leading cybersecurity teams, business strategies and security solution architecture. He also holds several relevant degrees and certifications, including as a Certified Information Systems Security Professional ("CISSP") and a Certified Secure Software Lifecycle Professional ("CSSLP"), and holds Honors BSc degrees in Computer Science and Physics.

companyName: SILICON LABORATORIES INC.

ticker: SLAB


text: We recognize the critical importance of cybersecurity in today's digital landscape and acknowledge the inherent risks associated with cyber threats. As such, cybersecurity is an integral component of our overall risk management strategy and corporate governance framework.

companyName: AZZ INC

ticker: AZZ


text: We periodically assess and test our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents, including those from third-party service providers who have access to our systems, data or are critical to our continued business operations. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to senior management and, if warranted, to our audit committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: FULLER H B CO

ticker: FUL


text: The Company's management has created an Incident Response Team ("IRT"), that consists of the Chief Operations Officer, a network manager, an application delivery manager, an information security manager, the IT Steering Committee, the regulatory risk management director and an internal auditor. Our COO holds multiple cybersecurity industry-recognized certifications and has gained extensive cybersecurity knowledge and skills through over 7 years of work experience on the IT security team at the Company. Our Information Security Manager, who also holds multiple cybersecurity industry-recognized certifications and is a member of the IT Steering Committee, has 20 years of experience working in IT and cybersecurity in various roles and industries throughout his career. Additionally, leaders in the Company's IT function receive periodic training and education on cybersecurity related topics. The IRT is governed by policies and procedures and their proactive responsibilities include implementing awareness programs for the overall cybersecurity risk management plan and for the supervision of vulnerability and penetration testing.

companyName: Carter Bankshares, Inc.

ticker: CARE


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, may be reasonably likely to materially affect our operations and, therefore, our results of operations and/or financial condition.

companyName: NET Power Inc.

ticker: NPWR


text: Risk assessments, including vulnerability scans and penetration testing to identify potential system weaknesses. These are performed internally and supported by third-party consultants; Alignment of our cybersecurity framework with industry standards;

companyName: HOOKER FURNISHINGS Corp

ticker: HOFT


text: Analyze all regulatory examination reports and internal and external audit reports impacting information technology as well as any required responses and/or updates. Assess the performance of the Committee and the Committee's role and responsibilities on an annual basis.

companyName: Waterstone Financial, Inc.

ticker: WSBF


text: In the event of a cybersecurity incident, the Company has processes by which the incident would be escalated internally and, when appropriate, reported to the Board or an appropriate committee of the Board, as well as for updating the Board regarding the incident until it has been resolved.

companyName: CROWN CRAFTS INC

ticker: CRWS


text: The Company maintains a cybersecurity risk management program that is led by our Chief Information Officer ("CIO") and our Senior Director of IT - Security and Compliance ("Senior Director of IT"). Our CIO has over 25 years of experience in information technology and cybersecurity and reports to our President and CEO. Our Senior Director of IT has over 20 years of experience in information technology and cybersecurity, holds several industry certifications including CISSP and CISA, and reports to the CIO. The Company's CEO, Chief Financial Officer ("CFO") and General Counsel each have over 20 years of experience managing risk at the Company or at similar companies, including risks arising from cybersecurity threats.

companyName: REV Group, Inc.


text: During 2023, the Corporation has not experienced a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the Corporation, including its business strategy, results of consolidated operations or financial condition. Refer to the risk factor captioned "Cyber Security Risks and Technology Dependence" in Part I, Item 1A. "Risk Factors" for additional information.

companyName: CITIZENS & NORTHERN CORP

ticker: CZNC


text: In our business operation, we utilize various third -party service providers, including credit card companies, banks and financial platform providers, to process financial transactions and implement various software and information system processes. To that effect, we seek to engage reliable, reputable service providers that maintain cybersecurity programs.

companyName: Stabilis Solutions, Inc.

ticker: SLNG


text: Risk Assessment. On a quarterly basis, the VP IT identifies and documents system internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, our Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The Compliance Committee reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.

companyName: Cullman Bancorp, Inc. /MD/

ticker: CULL


text: Our management team, including the Senior Vice President of Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes 25+ years of information management, governance and security controls for Fortune 500 organizations.

companyName: LIFECORE BIOMEDICAL, INC. \DE\

ticker: LFCR


text: As indicated above, we engage third-party providers to assist us with our cybersecurity risk management and strategy. Some of these providers provide us with ongoing assistance (such as threat monitoring, mitigation strategies, updates on emerging trends and developments and policy guidance) while we engage others to provide targeted assistance (such as security and forensic expertise) as needed. Prior to exchanging any sensitive data or integrating with any key third-party provider, we assess their security fitness against our risk posture and request changes as we deem necessary.

companyName: ON SEMICONDUCTOR CORP

ticker: ON


text: While we cannot guarantee complete effectiveness of our cybersecurity measures despite our best efforts and continuous monitoring, we believe that the Company's sustained investment in people and technologies has contributed to a culture of continuous improvement that has put the Company in a position to protect against potential compromises.

companyName: BTCS Inc.

ticker: BTCS


text: Our technology committee receives periodic reports from our security team concerning our significant cybersecurity threats and risk and the processes we have implemented to address them.

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: Periodically run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; Maintain cybersecurity insurance and regularly review our policy and levels of coverage based on current risks;

companyName: AvePoint, Inc.

ticker: AVPT


text: Key elements of our cybersecurity risk management program are integrated into our overall enterprise risk management program, and share common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO


text: Our program is informed by the International Standards Organization ("ISO") 27000, ISO 270001, and National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the ISO 27000, ISO 27001 and NIST CSF as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: The Company maintains a cyber liability insurance policy that is designed to cover certain expenses, business losses, business interruption, and fines and penalties associated with a data breach or other similar incident. Cyber liability insurance also provides coverage in the event of a ransomware attack.

companyName: Catheter Precision, Inc.

ticker: VTAK


text: The Company is committed to attaining the highest standards for information security and data privacy programs through disciplined governance and risk management practices.

companyName: Jackson Financial Inc.

ticker: JXN


text: Our management team, including our Chief Executive Officer and EVP, Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security consultants; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment. Our management team's experience includes monitoring the cybersecurity landscape for new risks and best practices, developing and executing cybersecurity strategies, overseeing related governance policies, testing compliance with applicable technical standards, remediating known risks and leading employee training programs.

companyName: AEON Biopharma, Inc.

ticker: AEON


text: Our incident response and crisis communications plans are designed to escalate certain cybersecurity incidents to members of the crisis management team depending on the circumstances, which includes our CISO, Chief Compliance Officer, General Counsel, corporate communications team and executive leadership as needed. This group works with our incident response team to help triage, contain, remediate, and recover from cybersecurity incidents of which they are notified. In addition, our incident response and crisis management plans include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Sprinklr, Inc.

ticker: CXM


text: Related to Cybersecurity Risks The Board of Directors ("Board") has delegated oversight of the Company's cybersecurity risk management program to the Audit Committee. The Audit Committee is composed of board members with diverse expertise, including in the areas of risk management, technology, and finance. The Audit Committee periodically provides input regarding cybersecurity topics and initiatives, including the results of assessments, and cybersecurity policies.

companyName: IROBOT CORP

ticker: IRBTQ


text: Our Board of Directors has overall responsibility for risk oversight including oversight of cybersecurity risk matters. The Board is responsible for reviewing, discussing with management, and overseeing the Company's data privacy, information technology and security and cybersecurity risk exposures, including: (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation; (ii) the programs and steps implemented by management to monitor and mitigate any exposures; (iii) the Company's information governance and cybersecurity policies and programs; and (iv) major legislative and regulatory developments that could materially impact the Company's data privacy and cybersecurity risk exposure. On no less than an annual basis, the Vice President, Information Technology reports to the Board on information technology and cybersecurity matters, including a detailed threat assessment relating to information technology risks, the potential impact of those exposures on the Company's business, financial results, operations and reputation, the programs and steps implemented by management to monitor and mitigate exposures, the Company's information governance and cybersecurity policies and programs, and significant legal/regulatory developments that could materially impact the Company's cybersecurity risk exposure.

companyName: OptiNose, Inc.


text: We have established an enterprise risk management ("ERM") program that considers our enterprise strategy, information from internal stakeholders, and information from external sources (e.g., emerging risks and trends, evaluations by third parties, and best practices) to identify, assess, categorize, and monitor risks including cybersecurity risks. The ERM program develops enterprise risk profiles to address individual risk drivers, develop action plans, and monitor against key risk indicators. At least annually, the ERM program is presented to our Board, Audit Committee, and members of management.

companyName: TENNANT CO

ticker: TNC


text: PACCAR maintains a comprehensive cybersecurity management and governance program, which includes the Company. The Company's information security management system is based upon the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). The Company engages internal and third-party auditors and other professional parties when necessary, as part of its cybersecurity management program. The Company conducts penetration and compromise assessment tests, implements detection and prevention tools, monitors cyber events and has active disaster recovery plans. For third-party IT services, the Company conducts an architectural, privacy and security analysis of their solution. If any gaps are identified, the third-party remediates or mitigates the risk to an acceptable level. The Company simulates potential cyber-attacks and performs incident responses to test PACCAR Financial Corp. (Millions of Dollars)

companyName: PACCAR FINANCIAL CORP


text: In an effort to protect our business from cybersecurity threats, we maintain and utilize various tools and processes that are designed to identify, assess, and manage cybersecurity risks. Our cybersecurity risk management program, which has been integrated into our enterprise risk management program, is based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Our cybersecurity risk management program focuses on monitoring the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents.

companyName: Tango Therapeutics, Inc.

ticker: TNGX


text: A third-party security information and event management ("SIEM") partner provides security monitoring and alerts twenty-four hours a day, seven days a week. The Company engages an independent Qualified Security Assessor organization to perform penetration testing in order to validate the Company's Payment Card Industry ("PCI") compliance and adherence to the PCI Data Security Standard. The Company also collaborates with outside legal counsel to ensure compliance with regulatory requirements.

companyName: DallasNews Corp


text: Our cybersecurity program is designed to monitor, detect, prevent and respond to cyber threats. We take a multi-faceted approach to identifying and mitigating information security risks. This includes but is not limited to penetration tests of our external network, the utilization of third-party scanning tools to monitor our network, maintenance of software and implementing applicable updates timely, training employees to recognize security risks and encouraging employees to report suspicious activity. Annual cybersecurity awareness training is provided to onshore and offshore users. The training seeks to demonstrate to users the risks in using technology and how to effectively defend against cyber threats.

companyName: HELIX ENERGY SOLUTIONS GROUP INC

ticker: HLX


text: Orchestra's Cyber Risk Committee, in conjunction with third-party IT and cybersecurity service providers is responsible for oversight and administration of Orchestra's cyber risk management program, and for informing senior management, the Board, and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Company's management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes via selection of strategic third-party partners (such as the Company's virtual Chief Information Security Officer), and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by Orchestra for strategic cyber risk management, advisory and decision making.

companyName: Orchestra BioMed Holdings, Inc.

ticker: OBIO


text: Key elements of Danaher's annual Enterprise Risk Management ("ERM") program include an inventory and classification of key risk areas and topics; a methodology for scoring risks based on the risk's probability, severity and velocity of impact, and for trending key risks; and a framework for developing and implementing countermeasures for key risks. Information technology/cybersecurity is one of five topical areas required to be addressed as part of the annual ERM program. IT and cybersecurity risks are required to be scored using the same methodology applied to all other risk categories, which facilitates an evaluation of the significance and prioritization of cyber-related risks relative to wider business risks. In addition, Danaher policy requires the reporting of certain cybersecurity incident data to Danaher's Risk Committee (comprising senior members of the legal, finance, internal audit and compliance functions) for consideration as part of the ERM process. Members of the Danaher Risk Committee present annually to the Danaher Board of Directors a report on the results of the ERM process, including with respect to information technology and cybersecurity risks. As part of our cybersecurity risk management program, we also maintain cyber insurance in amounts and subject to coverage terms that are typical for companies of our type and size, however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.

companyName: DANAHER CORP /DE/

ticker: DHR


text: The board of director's audit committee and the internal cybersecurity team help identify, assess and manage the Company's cybersecurity threats and risks, including through the use of our risk register. Our internal cybersecurity team includes our information security function, security management, engineering operations, legal, risk management and third-party service providers. Our cybersecurity team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and Personalis' risk profile using various methods including, for example: using manual and automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments, employee reporting, encryption of data, penetration testing, and regular reviews and internal and external audits.

companyName: Personalis, Inc.

ticker: PSNL


text: As of the date of this Annual Report on Form 10-K, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect our Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Item 1A. "Risk Factors – Risks Related to Cybersecurity, Data Security, and Privacy, Information Technology and Intellectual Property" for additional information about the risks to our business associated with a breach or compromise to our IT systems.

companyName: HF Sinclair Corp

ticker: DINO


text: Information Security Training and Awareness Information security awareness training is provided to all employees and Bank business units no less often than annually and focuses on: new hire orientation, the Company's overall information security program, roles and responsibilities of employees during an incident, how to report suspicious activity, and direction of employees to routinely check the Bank's cybersecurity blog for consistent and relevant information.

companyName: WILSON BANK HOLDING CO

ticker: WBHC


text: Moreover, the GlobalX Audit Committee remains committed to providing timely updates and detailed reports, offering insights into the airline's cybersecurity posture, ongoing initiatives, prevalent incident trends, and active remediation efforts. These reports are meticulously crafted, incorporating key metrics, performance indicators, and actionable recommendations aimed at continual enhancement.

companyName: Global Crossing Airlines Group Inc.

ticker: JETMF


text: The following describes the expertise of key members of management and our committees who are responsible for assessing, managing, and presenting quarterly updates to the Board's Risk Committee about our cybersecurity risks: • John Bresney, EVP & CIO, reports directly to our Chief Executive Officer and is responsible for all of our IT operations, including oversight of the SVP of Enterprise Strategy and Execution's implementation of our cybersecurity program and enforcement of our cybersecurity policies. We have employed him for approximately 30 years, and he has held various technology and information security roles of increasing responsibility. He has a bachelor's degree in information systems and business, a Master's Certificate in Project Management, and a Columbia University CIO Program Certificate. • Robert McKenna, SVP of Enterprise Strategy and Execution, reports to our CIO and leads the implementation of our cybersecurity program, enforcement of our cybersecurity policies, technology planning, projects driving IT strategy, and enterprise IT risk management. He also oversees cybersecurity incidents under our Security Incident Response Plan ("IRP"). We have employed him for approximately 21 years in related positions of increasing responsibility. He has over 27 years of technology and information security experience. He has a master's degree in business administration, a Certificate in Project Management, and is a Certified Insurance Counselor. • Christopher Cunniff, SVP and CRO, reports formally to the Chief Financial Officer and on an interim-basis to our Chief Executive Officer, leads our Reinsurance and ERM teams, and chairs the ERC and the Emerging Risk Committee. We have employed him for approximately six years, and he previously was our SVP of Actuarial Reserving. He has over 32 years of insurance industry experience, serving in various key leadership positions. He has a bachelor's degree in mathematics, is a fellow of the Casualty Actuarial Society, and is a member of the American Academy of Actuaries.

companyName: SELECTIVE INSURANCE GROUP INC

ticker: SIGI


text: The Company has appointed our CIO to establish, implement, and carryout our cybersecurity risk management policies and processes, including the Incident Management and Information Security Plan, and to facilitate the communication of such matters to the Risk Committee and the Board. Our CIO and other IT senior members of management responsible for our cybersecurity program have extensive experience assessing and managing cybersecurity risks. Our CIO and Security Team have over 30 years of experience in information technology and cybersecurity positions.

companyName: UNIVERSAL INSURANCE HOLDINGS, INC.

ticker: UVE


text: Our cyber risk management program is designed to follow the ISO 31000 and the NIST Special Publication 800-37 frameworks and is within the scope of our ISO 27001 certifications.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: NEE conducts periodic desktop exercises and an annual cybersecurity drill with the participation from time to time of local, state and U.S. federal agencies to test its capability of dealing with a simulated cyberattack. NEE also participates in industry forums and various trade groups, as well as in NERC activities, to learn and apply these incident preparedness learnings to its cybersecurity policies and procedures.

companyName: XPLR Infrastructure, LP

ticker: XIFR