text: Following these risk assessments, we redesign, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Executive Officer and Chief Financial Officer who manage the risk engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: BITMINE IMMERSION TECHNOLOGIES, INC.

ticker: BMNR


text: We have no t identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see Part I, Item 1A "Risk Factors— Our information technology systems, or those of any of our third-party service providers, may fail or suffer security incidents, breaches, or compromises and other disruptions, which could result in a material disruption of our development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."

companyName: Metsera, Inc.

secItem: Item 1C


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management ("ERM") program, and shares common methodologies, reporting channels and governance processes that apply across the ERM program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: DXC Technology Co

ticker: DXC


text: Our Security Culture We protect our information assets and manage risk by promoting a culture that communicates security risks, designs secure IT systems and operates according to approved processes to reduce the likelihood and impact of security incidents. We achieve this objective by: • Designing, implementing and maintaining solutions with appropriate security controls. • Sustaining solutions with required patching and vulnerability remediation. • Creating and executing controls in support of policy as well as regulatory compliance. • Ensuring that our policies, processes, practices and technologies proactively protect, shield, defend and remediate cyber threats. • Delivering quality communications and annual training to stakeholders on cyber awareness and computing hygiene.

companyName: TEXTRON INC

ticker: TXT


text: Our strategy for managing cybersecurity risk is multifaceted and includes, without limitation: (i) robust security policies and procedures, designed in part to comply with Payment Card Industry, or PCI, rules; (ii) an incident response plan, (iii) comprehensive system security elements and vulnerability scanning; (iv) periodic cybersecurity awareness training and testing for employees and certain contractors; (v) risk management of our third-party suppliers, vendors, and other partners, which includes risk-based diligence and contractual provisions that generally allow for periodic auditing, and (vi) security assessments of any businesses that we acquire.

companyName: 1 800 FLOWERS COM INC

ticker: FLWS


text: Board of Director's Governance The Board of Directors (the "Board") includes members with substantial cybersecurity expertise, ensuring informed oversight of cybersecurity risks. Documentation of the Board's involvement in cybersecurity oversight is maintained, highlighting the frequency and topics of discussions related to cybersecurity risks and incident response. The Board is regularly updated on cybersecurity risks and incidents through established reporting mechanisms, ensuring they are well-informed to make strategic decisions regarding the Company's cybersecurity posture.

companyName: T Stamp Inc

ticker: IDAI


text: Our cybersecurity program leverages both internal and external techniques and expertise across the cybersecurity spectrum. We maintain and utilize industry best practice capabilities, processes, and other security-related measures, based upon National Institute of Standards and Technology (NIST) and Control Objectives for Information Technologies (CoBIT) frameworks. Our capabilities, processes, and other security measures include, among others: Threat detection through the use of security information and event management software; Incident management processes for any security-related activity, requiring senior management signoff; Corporate endpoint detection and response software, which monitors for malicious activities on external-facing endpoints; Cloud monitoring tools, running on primary public and private cloud environments;

companyName: AMERICAS CARMART INC

ticker: CRMT


text: We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers that may be critical to the operations of our business and who have access to our information systems or store our confidential clinical trial data, including, as appropriate, through review of System and Organization Controls reports and security questionnaires and the inclusion of cybersecurity requirements in relevant contracts.

companyName: ImageneBio, Inc.

ticker: IMA


text: We maintain an Enterprise Risk Management ("ERM") program to identify and respond to the most critical risks to our business, including cybersecurity risks. Risks and vulnerabilities from our increased reliance on information technology systems are assessed at least annually as part of our ERM program. In response to such assessments, controls are embedded into our processes and technology by our Director of Operations & Information Technology to seek to mitigate risks to our systems and processes from cybersecurity incidents. We continuously evaluate if we have adequate controls in place utilizing a risk-based approach that aligns with the National Institute of Standards and Technology Cybersecurity Framework (NIST).

companyName: ENERGY FOCUS, INC/DE

ticker: EFOI


text: To date, we have not identified any material risks from cybersecurity threats, including as a result of any cybersecurity incident, which have materially affected, or are reasonably likely to materially affect, us, our business strategy, our results of operations, or our financial condition. As discussed more fully under "Item 1A. Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions the Company takes to reduce the risk of cyber incidents and protect its systems and information may be insufficient. See "Item 1A. Risk Factors, One or more cybersecurity incidents may adversely impact our financial condition, results of operations, and reputation" above for more information.

companyName: RADIUS RECYCLING, INC.


text: The Company employs management and staff members who hold top cybersecurity certifications and have acquired the expertise needed to manage the Company's cybersecurity program, including a range of technical skills such as intrusion detection, network security control, security incident management, and risk assessment. These management and staff members also participate in structured ongoing training to keep current with industry trends and cybersecurity threats.

companyName: GLACIER BANCORP, INC.

ticker: GBCI


text: Under our Cyber Program, our Senior Director, Global Security, and the staff. along with our management-led Cybersecurity Committee, with input where appropriate from our third-party advisors, work to identify our cybersecurity threats, assess the risks, and deploy appropriate technologies and processes to mitigate the risks. When cybersecurity incidents occur, these resources work to manage through the incident utilizing advanced security tools and playbooks, and in accordance with processes set out in various Company policies and practice documents, which include internal communications protocols to keep the executive team and, where appropriate, the Audit Committee and Board, informed. Pertinent policy and practice documents include, among others, Manhattan's Incident Response Policy, our Incident Escalation Matrix, our Materiality Determination Process for Cybersecurity Incidents (governing the Company's materiality determination for reporting purposes) and our Crisis Response Plan.

companyName: MANHATTAN ASSOCIATES INC

ticker: MANH


text: We have not experienced any cybersecurity incidents that have materially impacted or are likely to materially impact our business strategy, results of operations or financial condition based on information known to us as of the date of this Annual Report. Although we cannot eliminate all potential threats, our cybersecurity program is operated in a manner to minimize the likelihood of any threat becoming material and to keep pace with a constantly evolving cybersecurity landscape. For more information on risks from cybersecurity threats, refer to the risks described under "Risk Factors" included in Part I, Item 1A in this Annual Report.

companyName: UNITED NATURAL FOODS INC

ticker: UNFI


text: A discussion of how our business, financial condition, and results of operations could be materially adversely affected by risks from cybersecurity threats is contained under "Cybersecurity incidents could disrupt our business and result in the compromise of confidential information" in Item 1A. Risk Factors.

companyName: DOC DR Holdco, LLC


text: Ongoing Testing: EQT's comprehensive program encompasses a range of measures and enterprise-level drills. This includes conducting phishing test campaigns, mandatory annual training, annual penetration tests, and disaster recovery tests to ensure EQT's systems resilience. At the enterprise level, EQT also holds an annual tabletop exercise for EQT's core and extended crisis management teams, simulating various hypothetical scenarios to assess our preparedness and response strategies.

companyName: EQT Exeter Real Estate Income Trust, Inc.


text: We have policies, procedures, and processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats as well as secure our networks and systems. Such processes include procedural and technical safeguards, response plans, regular vulnerability and penetration tests on our systems and product applications, incident simulations, and routine review of our policies and procedures to identify risks and improve our practices. Our security incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to assess the severity of, escalate, contain, investigate, and remediate incidents as well as to comply with applicable legal obligations. We maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, and other related breaches.

companyName: CarGurus, Inc.

ticker: CARG


text: We prioritize the effective management of cybersecurity risks through a strategy focused on identifying, assessing, and responding to cybersecurity vulnerabilities, threats and incidents. Our primary objectives are to safeguard information assets, prevent their misuse or loss, and minimize business disruptions, through a comprehensive cybersecurity program intended to detect, analyze, contain and address cybersecurity risk exposures, threats and incidents.

companyName: CELESTICA INC

ticker: CLS


text: We require all our employees to take monthly training and testing on cybersecurity threats, including how to recognize and properly respond to phishing and social engineering schemes. We have deployed a phishing detection system to report suspicious emails, which are flagged for further review. We install and regularly update antivirus software on all company managed systems and workstations to detect and prevent malicious code from impacting our systems. We have an incident response plan in place in the event of a cybersecurity incident to guide our response and mitigation actions, which includes requiring our IT team to escalate incidents of a certain severity to the appropriate members of management.

companyName: USA Compression Partners, LP

ticker: USAC


text: As part of our overall risk management framework, our cybersecurity program is designed to identify, assess, and manage cyber risks. The program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks. We continually evaluate the current threat landscape to identify material risks arising from new and evolving cybersecurity threats.

companyName: Interactive Brokers Group, Inc.

ticker: IBKR


text: Tier 3. No direct system access but may be associated through a partnership or have links hosted embedded within Company marketing material or websites.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: Audit Committee Oversight The Audit Committee, comprising Board members with diverse experience in risk management, IT, cybersecurity, and finance, is directly responsible for overseeing cybersecurity risks. Our Chief Information Security Officer (CISO) provides comprehensive quarterly presentations to the Audit Committee, covering ongoing cybersecurity initiatives, strategies, and emerging threats. The Committee reports significant matters to the full board, and the CISO also delivers an annual presentation to the Board of Directors.

companyName: NERDWALLET, INC.

ticker: NRDS


text: The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; Cybersecurity awareness training of our employees, incident response personnel, and senior management;

companyName: Arteris, Inc.

ticker: AIP


text: Additionally, because Alight partners with a number of third parties in the ordinary course of business, our management team has developed and implemented processes to oversee and manage significant risks associated with use of third-party service providers. We conduct thorough security assessments of critical third-party providers before engagement and periodically monitor vendor compliance with our security standards. The monitoring includes periodic assessments by our vendor management team and use of an independent vendor risk rating service that alerts Alight when there is a change in a service providers security posture. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Alight, Inc. / Delaware

ticker: ALIT


text: Through the Company's ERM program, our Cybersecurity Governance Committee and Cybersecurity Risk Committee oversee the Company's cybersecurity initiatives. The Cybersecurity Governance Committee is responsible for monitoring, reviewing and reporting to the Audit Committee on cyber incident response. The Cybersecurity Risk Committee is responsible for communication of security incidents to organizational stakeholders.

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: The Company's third-party risk management program is designed to oversee and identify the cybersecurity threats associated with the use of third-party service providers. While the optics into a third-party's operation are limited, the Company performs risk-based evaluations of third-party service providers. These evaluations including reviewing information including, but not limited to, security assessment questionnaires, security testing summaries, audit reports performed under the SSAE 18 Audit Standard, and information security policies.

companyName: FIRST FINANCIAL BANKSHARES INC

ticker: FFIN


text: GLDM also relies on its other service providers, including the Administrator and the Custodians, to implement cybersecurity programs and engage external experts, including cybersecurity assessors, risk management and information technology professionals, attorneys, consultants and auditors to evaluate their cybersecurity measures and risk management processes.

companyName: World Gold Trust

ticker: GLDM


text: To mitigate risk, we utilize (i) firewalls to protect our network and Computing Equipment, (ii) anti-malware software to protect our Computer Equipment, (iii) device monitoring, (iv) physical security, (v) security and application lifecycle security, (vi) security updates and backups, and (vii) vulnerability and risk assessments.

companyName: Clene Inc.

ticker: CLNN


text: We maintain a Cybersecurity Incident Response Team composed of professionals across various functions, including information technology, legal, finance, accounting, and risk. This team is trained in managing cybersecurity incidents and is comprised of individuals with experience in various roles involving information technology, including, security, auditing, compliance, systems, and programming.

companyName: Piedmont Lithium Inc.


text: To identify and assess material risks from cybersecurity threats, we consider cybersecurity threat risks individually and alongside other company risks as part of our overall risk assessment process. Management determines and prioritizes appropriate risk responses for each identified enterprise risk. In doing so, management coordinates with relevant subject matter specialists as appropriate for each relevant risk area, including our third-party IT and cybersecurity team with respect to information technology and security risks.

companyName: CareTrust REIT, Inc.

ticker: CTRE


text: PetIQ has implemented cybersecurity processes and procedures in coordination with cybersecurity risk mitigation tools and services designed to help prevent, detect, and eradicate cybersecurity incidents. The CIO, who has more than 30 years of IT experience, has overall accountability for cybersecurity. The Cybersecurity Manager reports to the CIO. The Cybersecurity manager, who has overall responsibility for assessing and managing cybersecurity risk as well as managing and monitoring the cybersecurity technology stack, has more than 20 years of IT experience and is an ANSI/EC-Council certified CISO.

companyName: PetIQ, Inc.


text: Depending on the circumstances, information regarding cybersecurity risks and incidents may be elevated from the CISO and his team through a variety of different channels, including risk response forms as part of our formal security risk process, discussions with the Audit Committee and reports to the Board on a quarterly basis.

companyName: CLOVER HEALTH INVESTMENTS, CORP. /DE

ticker: CLOV


text: The ISO Committee meets quarterly and is comprised of the Company's Chief Executive Officer, Chief Financial Officer and Chief Legal Officer, whose relevant expertise and experience can be found in the Company's Proxy Statement on Schedule 14A filed on April 1, 2024.

companyName: First American Financial Corp

ticker: FAF


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past, and we could in the future experience similar attacks. As of Fiscal 2024, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operations or financial condition. For more information about the Company's assessment of cybersecurity risks, see the risk factor titled "A privacy breach, through a cybersecurity incident or otherwise, or failure to comply with privacy laws could have a material adverse effect on our business" in Part I, Item 1A, "Risk Factors".

companyName: Childrens Place, Inc.

ticker: PLCE


text: Our global information security program, led by our CISO, includes dedicated teams specialized in (i) identity access management, (ii) incident response, (iii) vulnerability governance, (iv) security operations and engineering (v) governance, risk, and compliance, and (vi) insider risk and intelligence. The members of the information security team are responsible for managing, maintaining, and monitoring the systems and processes that prevent, detect, mitigate and remediate cybersecurity incidents, and for informing our CISO of status of such systems and processes, as well as any significant incidents.

companyName: LAM RESEARCH CORP

ticker: LRCX


text: Our cybersecurity program is designed to identify, detect, protect against, respond to, and recover from cyber risks from the cyber threats we face. Our cybersecurity program is part of our internal risk management processes. We continually improve and revise our cybersecurity practices as new threats and vulnerabilities emerge.

companyName: AeroVironment Inc

ticker: AVAV


text: Our Senior Director of Information Technology (IT) is responsible for the strategic leadership and direction of our cybersecurity program. The Senior Director of IT has nearly 15 years of experience as an information technology professional.

companyName: Eightco Holdings Inc.

ticker: ORBS


text: Cybersecurity Board Governance Our board of directors considers cybersecurity risk as part of its risk oversight function. The Cybersecurity Management Team updates the board of directors, as necessary, regarding any significant cybersecurity incidents.


text: While our Board and Audit Committee oversee cybersecurity risk, senior management is responsible for actively managing cybersecurity risk, including overseeing and executing the risk management strategies discussed above. Senior management reports to the Board annually on our enterprise risk management processes, ensuring transparency and accountability.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: From the last quarter of 2023 through the date of this Report, the Company's President, Dennis Danzik, is responsible for managing the Company's cybersecurity risk. Mr. Danzik has served as the Company's President since 2022. His business experience includes industrial engineering, program development and technical management. Until the beginning of 2025, flooid/Quantum was a small company with a limited number of employees and any cybersecurity threat or incident, of which there were none, were immediately brought to the attention of Mr. Danzik. Further, as noted above, Mr. Danzik would immediately inform his fellow board members, including Messrs. Kitchen and Mr. Westbrook.

companyName: flooidCX Corp.


text: James Holley, the Global CISO, oversees our information, cyber, and technology security and reports to Neelu Sethi, the Company's Global CIO. Mr. Holley has over 30 years of leadership, operational and technical experience in information security. He leads the development, implementation and enforcement of security policies and data breach resiliency plans, as well as works with internal and external cybersecurity and IT teams to monitor and maintain the security of our IT infrastructure. Mr. Holley holds a Master's Degree in Computer Science with a concentration in information security as well as multiple information security certifications.

companyName: BRINKS CO

ticker: BCO


text: Cybersecurity continues to be a key governance priority for us. NACCO maintains a cybersecurity program that is aligned with our business and has established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, which have been integrated into our overall risk management processes and governance structure.

companyName: NACCO INDUSTRIES INC

ticker: NC


text: Engagement of Third Parties Given the complex and quickly evolving nature of cybersecurity threats, we engage third-party advisors to assist our team in developing and maintaining effective cybersecurity risk management. Partnering with external entities allows us to leverage specialized knowledge and insights, better ensuring our cybersecurity strategies and processes are well-designed and effective. For example, in 2023 we engaged a global cybersecurity leader to conduct an external assessment of our Information Security program, which included consideration of the cybersecurity framework, organizational structure and collective capabilities.

companyName: WOLFSPEED, INC.

ticker: WOLF


text: Strategy and Processes Our Chief Information Security Officer (CISO) leads our Global Information Security team, reports to the Chief Information Officer (CIO), and meets regularly with other members of senior management. Our CISO holds advanced degrees in Computer Science and Business Administration, in addition to relevant IT and cybersecurity certifications from organizations such as the EC Council, ISACA, and CSA. She has served in various IT roles for over 20 years, including leading the IT Security function.

companyName: BROWN FORMAN CORP

ticker: BF-A


text: During the year ended December 31, 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.

companyName: DarkPulse, Inc.

ticker: DPLS


text: The VP of IT has twenty seven years of experience in information technology, fifteen of which have involved IT leadership for various organizations. Our Director, IT Governance and Security (the "Director, IT") reports to our VP of IT and is responsible for the day-to-day management of our cybersecurity risk management program. The Director, IT has eighteen years of experience in information technology. The Director, IT receives support from our operational team which comprises cybersecurity, IT, controllership, and legal professionals who regularly review cybersecurity matters and evaluate emerging threats, as well as act as first responders to triage any cybersecurity incidents. In the event of a cybersecurity incident, the Committee and Board receive updates from this team on an ad-hoc basis, if appropriate, under our tiered escalation support framework.

companyName: KULICKE & SOFFA INDUSTRIES INC

ticker: KLIC


text: Adrian J. Holt, age 55, is Senior Vice President and Chief Human Resources Officer. Mr. Holt is responsible for human resources strategy and services worldwide, which includes employee engagement, total rewards, learning and leadership development, and global talent acquisition and management. Mr. Holt joined Eastman in 2016 as Vice President, Global Talent Acquisition and HR Client Support, Americas and EMEA. Prior to Eastman, Mr. Holt served as Chief Human Resources Officer for WireCo World Group and as Vice President of Corporate Human Resources for BASF North America. Mr. Holt was appointed to his current position effective May 2023.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: Our Board of Directors has overall responsibility for the oversight of risk management, including cybersecurity risks. The Board receives periodic briefings on cybersecurity matters, including key risks to the Company, recent developments and risk mitigation activities from management.

companyName: Forward Industries, Inc.

ticker: FWDI


text: Key elements of the Company's cybersecurity program are a formal Risk Management Strategy within ISMS, which is based on the ISO 27001 framework, and an Incident Response Plan, which establishes the process for the Company to identify, assess, mitigate, and remediate risks from cybersecurity events and incidents, including internal notification, breach reporting, and external communications protocols for material incidents. The Company responds to risks in a prioritized fashion. Remediation priority considers the risk likelihood and impact, cost, work effort, and availability of resources.

companyName: SIGMATRON INTERNATIONAL INC


text: Our Global Data Privacy Program continues to align with environmental, social, and corporate governance standards, taking into account both the risks and benefits of privacy-driven spending. The program's operating model is based on the General Data Protection Regulation, adjusted to meet specific local requirements. This scalable model manages strategic, operational, legal, compliance, and financial risks and benefits, and utilizes technology to automate portions of the program, such as data subject access requests and consent and preference management.

companyName: VALMONT INDUSTRIES INC

ticker: VMI


text: The Audit Committee of our Board of Directors is the governance body involved in, and ultimately responsible for, cybersecurity oversight. They will generally coordinate with our Chief Financial Officer in this regard, with management alerting the committee members to any specific concerns of which management may be aware. In the event of a cybersecurity concern or event, our Chief Financial Officer would report the events or his or her concerns to our Audit Committee and full Board of Directors, as well as legal counsel. None of our directors on the Audit Committee nor our Chief Financial Officer have particular experience in cybersecurity matters.

companyName: SUI Group Holdings Ltd.

ticker: SUIG


text: For the year ended December 31, 2023, the Company has not identified any specific risk from a cybersecurity threat that has materially affected, or is reasonable likely to affect, the Company's business strategy, results of operation, or financial condition, other than those described in Item 1A. Risk Factors - Risks Related to Technology.

companyName: LAKE SHORE BANCORP, INC.


text: We have developed and implemented a cybersecurity framework intended to identify, assess, monitor and manage risks from cybersecurity threats to the security of our information, systems and network using a risk-based approach. Our framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although our framework takes into account the particulars of our business and our diverse network of terminal operations and does not meet all the technical standards, specifications or requirements under the NIST. Additionally, the Company follows IT General Controls that were implemented to adhere to Sarbanes-Oxley internal controls.

companyName: TransMontaigne Partners LLC


text: Our Disclosure Committee includes key executives and senior leadership, including the Executive Vice President, Chief Growth and Operations Officer, Chief Financial Officer, CIO, Senior Vice President of Finance, Senior Vice President of Investor Relations and Treasurer, Senior Vice President of Legal Counsel and Vice President of Legal Counsel. Additionally, it comprises senior representatives from financial reporting, internal audit, financial planning and analysis, and tax functions, ensuring a comprehensive approach to risk oversight and compliance.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: Our Board of Directors ("Board") generally oversees Columbia's risk management practices and processes. Annually, the Board reviews the results of the annual enterprise risk management program, including updates from our CISO related to cybersecurity matters. The Audit Committee also receives an update on the enterprise risk management program annually. The Board has delegated primary oversight of the management of cybersecurity risk to the Audit Committee. The Audit Committee annually reviews the strategies, investments and risk related to Columbia's information technology systems, including a review of Columbia's cybersecurity programs, and also receives quarterly updates from our CISO. The Board is informed of cybersecurity events to the extent they may materially impact Columbia or management otherwise believes they should be escalated.

companyName: COLUMBIA SPORTSWEAR CO

ticker: COLM


text: We have monitoring systems which are designed to identify potential cybersecurity events, including threats and incidents. These monitoring systems are managed by our Global Security Operations Center, which employs cybersecurity professionals in the United States and in certain foreign countries in which we operate to provide better coverage and response actions.

companyName: HERBALIFE LTD.

ticker: HLF


text: Managing Material Risks & Integrated Overall Risk Management Via Renewables, Inc. has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integrated part of our decision-making processes at every level. Our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Via Renewables, Inc.

ticker: VIASP


text: Our management team, including our Chief Compliance Officer, Chief Information Officer, SVP, Privacy & Cybersecurity, and SVP, Cybersecurity, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Information Officer is responsible for implementation and enforcement of written information security policies. The Chief Information Officer has designated leaders, including the SVP, Cybersecurity, to be responsible for overall management of the information security management program, including developing and operating within the defined global information security controls to protect our IT systems, selecting and supervising retained cybersecurity consultants, and working with Legal, Compliance, and Human Resources personnel to develop and launch appropriate information security training of our workforce. Our management team has decades of experience leading and managing cybersecurity teams as well as professional credentials in cybersecurity and data privacy. Our SVP, Privacy & Cybersecurity, leads a team of five dedicated privacy professionals in the Legal department.

companyName: Endeavor Group Holdings, Inc.


text: The Company's Chief Finance Officer ("CFO") and Associate Vice President of Information Technology ("AVPIT") help identify, assess and manage cybersecurity risk, including input from employees, and devote resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats. The CFO and AVPIT identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example maintaining manual and automated tools, conducting scans of threats and actors, subscribing to reports and services that identify cybersecurity threats, evaluating threats reported to us, completing internal and external audits, using external intelligence feeds and completing third-party threat assessments.

companyName: DELCATH SYSTEMS, INC.

ticker: DCTH


text: Our board of directors oversees risk for our Company. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our IPO.

companyName: Everest Consolidator Acquisition Corp


text: The Strategy and Risk Committee of the Board (the " Strategy and Risk Committee ") oversees the Company's cybersecurity risks and strategy, including our Cybersecurity Program. A member of the Strategy and Risk Committee has bachelor and doctoral degrees relevant to and experience in cybersecurity and information technology trends. Management provides the Strategy and Risk Committee with periodic reports on cybersecurity risks, risk mitigation in place and planned, and any material cybersecurity incidents. These reports are provided to our Board of Directors. If a material cybersecurity incident were to occur, the Audit Committee of the Board would oversee the financial reporting and disclosure and law compliance aspects.

companyName: DAKTRONICS INC /SD/

ticker: DAKT


text: The Director of IT meets with the Chief Financial Officer periodically to discuss and review our cybersecurity risk management processes and to address matters related to potential cybersecurity and information technology risks, with input from the Company's third-party technology providers, as appropriate. The Chief Financial Officer provides periodic reports on cybersecurity and information technology matters to the audit committee, which is responsible for reviewing and overseeing the Company's risk management process, including risks from cybersecurity threats, as set forth in the audit committee charter. The audit committee periodically reports on cybersecurity risk management to the full board of directors.

companyName: Cabaletta Bio, Inc.

ticker: CABA


text: While risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. See "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K for further information regarding cybersecurity risks.

companyName: PIXELWORKS, INC

ticker: PXLW


text: Our CISO leads an in-house information security team responsible for cybersecurity risk and threat evaluation; the writing of relevant policies, control standards, and technical requirements; and the oversight and operation of security controls. The Security Operations team monitors for potential incidents via a global team operating 24 x 7 x 365 in a "follow the sun" model. We also engage outside experts where a third-party opinion or subject matter expertise provides specific value, such as with penetration testing. We use industry-leading security tools, regularly update our technology roadmaps, conduct tabletop exercises and mandate cybersecurity awareness and training for all employees.

companyName: Vistance Networks, Inc.

ticker: VISN


text: Collaborative Approach The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Quad/Graphics, Inc.

ticker: QUAD


text: The Board is aware of the critical nature of managing risks associated with cybersecurity threats. The Audit Committee is responsible for board-level oversight of cybersecurity risk. The Audit Committee reports back to the full Board about cybersecurity and other areas within their responsibility.

companyName: Titan Machinery Inc.

ticker: TITN


text: We continuously monitor and update our information technology networks and infrastructure to prevent, detect, address and mitigate risks associated with unauthorized access, misuse, computer viruses and other events that could have a security impact. We invest in industry standard security technology to protect the Company's data and business processes against risk of cybersecurity incidents. Our data security management program includes identity, trust, vulnerability and threat management business processes, as well as adoption of standard data protection policies. We measure our data security effectiveness by benchmarking against industry-accepted methods and we work to remediate any significant findings. We maintain and routinely test backup systems and disaster recovery and also have processes in place to prevent disruptions resulting from our implementation of new software and systems.

companyName: HERSHEY CO

ticker: HSY


text: The Company's Chief Information Security Officer ("CISO") is responsible for assessing, identifying, and managing our risks from cybersecurity threats. This individual has over 30 years of experience in information security positions. Our CISO holds the Certified in Risk and Information Systems Control ("CRISC") certification from the Information Systems Audit and Control Association, a leading independent cybersecurity association.

companyName: Primo Brands Corp

ticker: PRMB


text: The Company's Incident Response Team is led by our Director of Information Technology and also comprised of various cross-functional members of management. The team is responsible for identifying, assessing, mitigating, and reporting on material cybersecurity risks and will present regular reports to the Audit Committee and the Board. The Board and the Audit Committee are also informed of any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed.

companyName: Canterbury Park Holding Corp

ticker: CPHC


text: Management oversight of cybersecurity risks is provided through the Company's internal ERM committee, which is comprised of executive management and our Director of Actuarial Services. The ERM committee has identified numerous risk attributes and developed risk control reports that identify drivers, characteristics, stress testing levels, potential mitigation efforts, or risk appetite, and any reaction in response to a breach. The ERM committee meets quarterly to review and update risk limit grids, current estimates relative to pre-defined acceptable levels, and make adjustments as needed.

companyName: ICC Holdings, Inc.


text: The CSO is responsible for assessing and working with the business to manage the Company's material risks from cybersecurity threats. The CSO is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management and strategy process described above, including the operation of Veradigm's incident response plan. Veradigm's CSO has served in this role for the past four years, and has more than 14 years of experience managing cybersecurity risk for HIPAA-regulated entities in various roles involving managing information security, developing cybersecurity strategy, application security, and developing healthcare cybersecurity at the Federal level, and has a Doctorate of Philosophy (Ph. D.) in privacy and security.

companyName: Veradigm Inc.


text: Our Enterprise Risk Management Committee includes a cross-functional team including the Chief Executive Officer, CIO, Chief Financial Officer and the General Counsel as members who are well versed in risk management. In addition, the Enterprise Cybersecurity Committee includes the CIO, CISO, and Vice Presidents who have the relevant risk management and cybersecurity expertise. The Cybersecurity and Information Services department is led by the CISO and includes cyber professionals who have the relevant cybersecurity expertise. The CISO reports to the CIO and has over 20 years of experience, a graduate degree and several certifications in the field of cybersecurity. Material risks are managed and monitored by persons or committees with relevant expertise and experience. The Company maintains a Cybersecurity incident response team and a Business Continuity Plan and has a well-established incident reporting protocol to inform management, the Board of Directors or third parties.

companyName: EXPEDITORS INTERNATIONAL OF WASHINGTON INC

ticker: EXPD


text: We work with third-party service providers from time to time that assist us to identify, assess and manage cybersecurity risks, including professional SEIM SOC and other services firms, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing. No risks from cybersecurity threats have occurred that have affected our business, results of operations or financial condition.

companyName: Protalix BioTherapeutics, Inc.

ticker: PLX


text: The Company regularly assesses and tests its cybersecurity policies, standards, processes, and practices, including but not limited to audits, tabletop exercises, threat modeling, and penetration and vulnerability testing. The Company regularly engages outside advisors and experts to anticipate future threats and trends and to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits, and reviews are reported to the Cybersecurity Committee, Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: Axsome Therapeutics, Inc.

ticker: AXSM


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity processes to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our approach to assessing, prioritizing, and effecting cybersecurity processes and projects is based on standards from the National Institute of Standards and Technology (NIST).

companyName: TENNANT CO

ticker: TNC


text: The Company's third-party risk management framework and processes have been aligned with regulatory requirements and we believe with industry best practices to oversee and identify risks from cybersecurity threats associated with use of third-party service providers. We take a risk-based approach in performing cybersecurity assessments of third-party service providers at the time of onboarding, as part of regular ongoing monitoring, at the time of contract renewal, and upon detection of any increase in risk profile. Our information security division collaborates with our third-party risk management unit to evaluate the information technology and security programs of significant third party service providers. As applicable, these reviews evaluate the design and operational effectiveness of information technology and security related controls employed by service providers. In addition, the third party's information technology and security policies and procedures are evaluated to form an overall opinion of the third party service provider's technology and information security posture.

companyName: BankUnited, Inc.

ticker: BKU


text: Our Chief Executive Officer ("CEO") is responsible for assessing and managing overall material risks to the Company. With respect to cybersecurity risks, our CEO leverages the collective expertise of the Company's information security function which reports to our CEO through the Company's Chief Information Officer. The information security function is staffed with individuals with extensive information security employment experience, including in the financial services sector, educational experience and relevant credentials. The Audit Committee of the Board of Directors (the "Audit Committee") is responsible for receiving periodic updates on cybersecurity and information security risks, reviewing and discussing with management the quality and effectiveness of the Company's efforts to mitigate such risks and reporting such findings to the Board of Directors. Management informs the Audit Committee about prevention, detection, mitigation and remediation of cybersecurity incidents at least annually and monitors such matters continuously.

companyName: Kinsale Capital Group, Inc.

ticker: KNSL


text: We recognize the importance of cybersecurity in protecting our operations, customer information, and proprietary data. We are committed to implementing robust security measures to mitigate the risk of cyber incidents that could potentially disrupt our business operations or compromise the integrity of our data.

companyName: AppTech Payments Corp.

ticker: APCX


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: NETGEAR, INC.

ticker: NTGR


text: Our information systems have been subject to cybersecurity incidents in the past, including a cyber-attack identified and disclosed during the fourth quarter of 2024 (the "Cybersecurity Incident") that temporarily disrupted our business operations, including our ERP systems, and had an impact on manufacturing, order processing, shipping, and other corporate operations. Although we are continuing to work with our insurer to recoup covered losses, we do expect to continue to incur expenses in connection with improving our global cybersecurity infrastructure and cybersecurity posture.

companyName: ARTIVION, INC.

ticker: AORT


text: In the event of a cybersecurity incident, the Company has a process in place whereby members of the security group will alert the CISO and the CISO will alert the appropriate levels of management, including an incident assessment team, as well as the legal and finance departments so that the materiality of any such event can be assessed in furtherance of fulfilling any reporting requirements. If warranted, senior management will notify the Audit Committee or the full Board, as appropriate.

companyName: Merck & Co., Inc.

ticker: MRK


text: It is management's responsibility to manage cybersecurity threats, as described above, and bring to the Board's attention any material threats. Under the oversight of the Audit Committee, the Company's CEO is primarily responsible for the assessment and management of cybersecurity threats and utilizes third-party consultants retained by the Company for advice.

companyName: INTERNATIONAL TOWER HILL MINES LTD

ticker: THM


text: All Company e-mails are protected by a cloud-based email filtering service designed to protect the Company against advanced threats related to email and collaboration tools. Periodically, all users on the Company's computer network are required to perform multi-factor authentication. The Company uses a cloud-based identity and access management service that enables access to external resources. Backup is performed using a secure, automatic cloud-based backup and restore service.

companyName: Microbot Medical Inc.

ticker: MBOT


text: We have not identified an indication of a substantive cybersecurity incident that would have a material impact on our business, results of operations or financial statements. For additional information regarding risks from cybersecurity threats, please refer to Item 1A. Risk Factors above.

companyName: BATTALION OIL CORP

ticker: BATL


text: Management is responsible for assessing and managing risks from cybersecurity threats and implementing the Company's cybersecurity strategies. The Company has a Chief Technology Officer ("CTO") that focuses on current and emerging cybersecurity matters and is responsible for establishing and maintaining the Company's cybersecurity-related policies and procedures. Our CTO has an Engineering degree from Rice University, a Master of Business Administration from Harvard Business School, more than 20 years' work experience, and a background in leading digital / software development organizations. Supporting our CTO is the Company's Vice President of Corporate Platform and Infrastructure and our team of cybersecurity experts. Our Vice President has an undergraduate degree from The University of Houston and has served in various Information Technology and Information Security roles for over 20 years across Oil & Gas, Consulting, and Power Generation sectors. This team is collectively responsible for upward reporting on an as-needed basis of emerging cybersecurity incidents to senior management and, if appropriate, the Audit Committee of the Board of Directors. To facilitate effective oversight, our Technology Team holds regular discussions with our management team and the Board of Directors around cybersecurity risks, incident trends, and the effectiveness of our cybersecurity measures.

companyName: Select Water Solutions, Inc.

ticker: WTTR


text: The Company's management is responsible for overseeing and managing our cybersecurity risks and activities as part of its overall risk assessment portfolio. Our management regularly evaluates and reviews the Company's cybersecurity posture and performance and reports to the board of directors on any material cybersecurity matters or developments. Our management also coordinates with our CROs, vendors, partners, and other third parties to ensure that they comply with our cybersecurity expectations and requirements and to address any cybersecurity issues or concerns that may arise.

companyName: TELIX QSAM INC.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of the Company's enterprise risks, including cybersecurity and other information security risks. The Committee oversees management's implementation of our cybersecurity risk management program. Also, the Company created a Risk Management Working Group which meets no less than quarterly and which receives updates on the Company's cybersecurity risk management program and cybersecurity risks from the Chief Information Security Officer ("CISO"). The Risk Management Working Group includes two Audit Committee members, certain members of senior management and the CISO.

companyName: Intapp, Inc.

ticker: INTA


text: Management and Strategy periodically assess risks from cybersecurity threats, and monitor our information systems for potential vulnerabilities. However, to date, given the small size of our company and the nature of our operations, our reliance on information systems has been limited to the use of standard off-the-shelf software (such as Google, QuickBooks and Microsoft Office) and the use by our employees of standard personal computers. Accordingly, management has not implemented any formal process for assessing, identifying, and managing risks from cybersecurity threats.

companyName: One World Products, Inc.

ticker: OWPC


text: The Company prioritizes and maintains a high level of commitment to responsible and secure cybersecurity practices given the critical nature of its services and the potential consequences of a successful cyber-attack on the Company and the electric grid. A successful cyber-attack could have far-reaching consequences, from compromising the integrity of sensitive data to disrupting power supply. To that end, the Company implements a robust risk management, strategy, and governance regime aimed at ensuring effective controls are in place to identify, mitigate, remediate, and communicate cyber threats at appropriate levels within the organization.

companyName: ARIZONA PUBLIC SERVICE CO


text: Cybersecurity risk management is a significant part of our overall risk management process. Our cybersecurity risk management program is informed by security frameworks and standards, such as PCI DSS, ISO 27001, and CIS Controls. We have designed and implemented various information security processes that are intended to protect the confidentiality, integrity, security, and availability of our critical systems and information and provide a cross-functional framework for identifying, preventing, and mitigating cybersecurity threats and incidents, including threats and incidents associated with the use of applications developed and services provided by third-party service providers.

companyName: Olo Inc.


text: Our approach to cybersecurity risk management includes multiple complementary elements to mitigate our cybersecurity risks. We utilize multi-layered defenses to help prevent attacks including the use of data analytics to help detect anomalies and search for cyber threats. We have comprehensive cyber threat detection and response capabilities with applied threat intelligence, and continuous monitoring to complement other technology, processes and threat detection techniques we have in place. We subscribe to third-party managed security services that continuously monitor our systems and networks to assist with early cybersecurity threat detection and protection.

companyName: AAR CORP

ticker: AIR


text: Monitoring Controls. In addition to the Company's cybersecurity policies and procedures, the Company places a significant emphasis on monitoring controls as a critical component of its cybersecurity strategy. These controls are designed to enable the Company to consistently oversee and evaluate the effectiveness of the Company's cybersecurity measures to help ensure prompt detection of and response to potential threats or anomalies.

companyName: EVgo Inc.

ticker: EVGO


text: The foregoing responsibilities are covered on a day-to-day basis by our CISO and their team. The cybersecurity department consists of cybersecurity professionals with varying degrees of education and experience. Individuals within the cybersecurity department are generally subject to professional education and certification requirements. Our CISO has substantial relevant expertise and formal training in the areas of cybersecurity risk management, including 25 years of cybersecurity experience in the financial services, retail, insurance sectors.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: The Senior Vice President of Information Technology ("IT") works with the Managed Service Provider (MSP) information security team, which is responsible for maintaining and implementing our enterprise-wide cybersecurity strategy, standards, and architecture processes. The Director of IT is responsible for the IT-related security policies. The Director of IT, in coordination with compliance, the information security officer, and human resources, conducts at least annual and ongoing company-wide information security awareness training. We have developed processes to identify and oversee risks from cybersecurity threats associated with third-party service providers, which include the Director of IT, vendor management team and the business department head assessing cybersecurity robustness during vendor review before onboarding, the inclusion of protective provisions in vendor agreements, and risk-based monitoring of vendors on an ongoing basis.

companyName: GLEN BURNIE BANCORP

ticker: GLBZ


text: Policies, procedures and controls under our cybersecurity program are designed in consideration of published frameworks, including the Center for Information Security ("CIS") Critical Security Controls, and routinely evaluated for ongoing adherence to those frameworks. Our cybersecurity program includes a process for incident response and continuous improvement. We periodically enlist outside advisors to evaluate the maturity of our cybersecurity program, review processes and policies, conduct penetration and vulnerability tests and simulation exercises, and to monitor and help identify potential cybersecurity incidents. We provide annual cybersecurity awareness training to our employees and contractors to help identify potential cybersecurity threats and attacks, perform targeted phishing campaigns, use multifactor authentication for secure access to our systems and networks and tabletop exercises to simulate and prepare for potential incidents. When considering to engage with third-party service providers, we assess the risks from cybersecurity threats posed by such engagement and continue to evaluate those risks throughout the duration of the relationship.

companyName: GRACO INC

ticker: GGG


text: Monitoring Cybersecurity Incidents. On a daily basis, our information security team monitors, identifies and classifies potential cybersecurity events and is responsible for notifying the COO and CISO of such events as appropriate based on risk to our organization. Our COO and CISO are responsible for notifying executive leadership, other functional teams and our audit committee, as appropriate.

companyName: Frontdoor, Inc.

ticker: FTDR


text: Governance of information security risks We have also established a risk governance committee, which generally meets on a monthly basis. This committee, which is sponsored by the Chief Technology Officer, is comprised of Company associates from information security, information technology (IT), engineering, and other functions, who have experience in managing cybersecurity risks, who review the cybersecurity threat landscape, and who evaluate key emerging data security risks. The committee reviews certain cybersecurity-related risks facing the company; discusses open policy exceptions and key risk indicators; and manages cybersecurity risks presented by the information security team and proposed mitigation actions. Members of this committee review the key risks identified as an outcome of our cybersecurity risk management strategy described below.

companyName: Outset Medical, Inc.

ticker: OM


text: The Company recognizes the increasing complexity and significance of cybersecurity risks in safeguarding its technology, operations, and customer data. As an advanced electric vehicle manufacturer, the Company's operations rely on interconnected digital infrastructure, cloud-based systems, and proprietary software platforms, making cybersecurity an essential component of its risk management framework.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: Our Chief Technology Officer oversees our cybersecurity policies and processes and will provide periodic briefings to the Chief Executive Officer, the Audit Committee and/or the Board of Directors as needed regarding any material cybersecurity risks or activities, including any recent cybersecurity incidents and related responses.

companyName: Verde Clean Fuels, Inc.

ticker: VGAS


text: Our commercial success depends on developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data. Accordingly, we have adopted processes designed to identify, assess and mange material risks from cybersecurity threats.

companyName: Array Technologies, Inc.

ticker: ARRY


text: Our risk assessment and mitigation program is centered on three key components: identification of risks, which involved input from different groups across our company;

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: Risks from Cybersecurity Incidents Arcosa has not been subject to cybersecurity incidents that have materially affected, or are reasonably likely to materially affect the Company, its operations, or financial standing.

companyName: Arcosa, Inc.

ticker: ACA


text: The Company maintains robust and comprehensive processes, procedures and controls to protect and secure its information systems and data infrastructure from cybersecurity threats. The Company's cybersecurity program is led by its Chief Information Security Officer ("CISO"). The Company's cybersecurity program interfaces with other functional areas within the Company, including but not limited to the Company's business segments and information technology, legal, risk management, human resources and internal audit departments, as well as external third-party partners, to identify and understand potential cybersecurity threats. The Company regularly assesses and updates its processes, procedures and management techniques in light of ongoing cybersecurity developments.

companyName: Builders FirstSource, Inc.

ticker: BLDR


text: We recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of our prevention efforts is comprehensive employee training to recognize and respond to cybersecurity threats. All new hires receive mandatory privacy and information security training. Employees must also complete mandatory ongoing annual cybersecurity and data trainings, which are supplemented throughout the year by regular phishing and other cyber-related testing. Additionally, we conduct specialized training for our high-risk employees on an annual basis and specialized training for employees with access to certain sensitive information systems. These trainings and tests are tracked throughout the year for each employee and are directly tied to their overall compensation.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: Audit Committee Oversight of Cybersecurity Risks Our Audit Committee provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Audit Committee receives periodic updates from our Response Team regarding the overall state of our Advisor's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.

companyName: Horizon Technology Finance Corp

ticker: HRZN


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.

companyName: STANDARD PREMIUM FINANCE HOLDINGS, INC.

ticker: SPFX


text: As of the date of this Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition at this time.

companyName: Longevity Health Holdings, Inc.

ticker: XAGE


text: Cybersecurity is a key component of the Company's overall risk management system, and the Company believes it has implemented robust processes that are designed to effectively manage risks from cybersecurity threats. In addition to maintaining insurance coverage to address cyber incidents, the Company has also implemented processes, procedures and controls to help mitigate these risks. Domino's cybersecurity program is embedded into the Company's enterprise risk management framework from both a resource allocation and strategic initiative perspective and is supported by an extensive catalog of layered security controls that are designed to prevent and detect internal and external security threats and safeguard privacy and personal data of customers, team members, franchisees and other business partners. Domino's maintains this comprehensive information security program with a dedicated team that is responsible for directing, coordinating, planning and organizing information security activities throughout the Company and is led by the Company's CISO.

companyName: DOMINOS PIZZA INC

ticker: DPZ


text: Integrated Cybersecurity Risk Management Verizon's Senior Vice President and Chief Information Security Officer (CISO) has responsibility for the management of cybersecurity risks at Verizon. The CISO and her team are responsible for Verizon's information security strategy, policy, standards, architecture and processes.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: Integrated Risk Management Management is responsible for the day-to-day management of the Company's risk exposures in a manner consistent with the strategic direction and objectives established by the Board. As a critical component of the Company's risk management process, management has adopted an integrated risk management framework to continuously identify, assess, measure, manage, monitor and report current and emerging non-financial risks. As part of this framework, the Company has an Enterprise Risk Management ("ERM") Committee which is chaired by the Company's Chief Risk Officer. Our Chief Information Security Officer ("CISO") is also a member of the ERM Committee. The ERM Committee oversees the Company's risk management framework, including the implementation of the framework components across the Company and promotes a strong Company-wide culture of risk management, compliance and control.

companyName: S&P Global Inc.

ticker: SPGI


text: The Board, directly and through its committees, oversees our risk management process, including cybersecurity risks and regularly receive presentations and reports from management. Pursuant to the Risk Management and Compliance Committee Charter, the Risk Management and Compliance Committee of the Board provides compliance oversight of our risk assessment and risk management policies, which include cybersecurity, and receives regular reports and updates on the steps management has taken to monitor and mitigate such exposures and risks.

companyName: Global Business Travel Group, Inc.

ticker: GBTG


text: Functionally, our cybersecurity team performs internal and external risk assessments and testing on both internally and externally developed systems, as well as certain third-party and supply chain partner ecosystems based on our assessment of their respective operational criticality and risk profile. Depending on the risks presented, this may include some combination of manual and automation-driven testing methods and supply chain risk management activities such as hardware and software assurance assessments, anti-counterfeit measures, and the use of trusted suppliers. Compliance with security policies, procedures, and standards are assessed, and depending on the potential risks posed to us, third-party assessments may be performed, including penetration tests, red team engagements, gap assessments, and compliance certification assessments. We also conduct several 3rd party compliance and audit assessments, including PCI DSS Tier 1 Merchant and Service Provider, ISO 27001, UK Cyber Essentials Plus, and DFARS 252.204-7012 High Assurance assessments.

companyName: VIASAT INC

ticker: VSAT


text: We seek to detect and investigate unauthorized attempts and attacks against our network and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes, tools and changes or updates to our products; however, we remain potentially vulnerable to known or unknown threats. In some instances, we, our suppliers, our customers and the users of our products can be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Risk Factors" for more information on our cybersecurity risks and product vulnerability risks.

companyName: BK Technologies Corp

ticker: BKTI


text: We monitor the effectiveness of our information security program in protecting information assets and sensitive data, and mitigating security risks by periodically performing both internal and external audits, leveraging third-party commercial tools for assessing cybersecurity health, monitoring and addressing newly defined security vulnerabilities, and conducting annual third-party cyber penetration testing. Such tests are designed to emulate techniques used by advanced cyber threat adversaries. We also recognize that third-party service providers may introduce cybersecurity risks and, in an effort to mitigate these risks, we have sought to implement a process to assess and oversee the cybersecurity practices of third-party service providers. Before engaging with a third-party service provider, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to include cybersecurity requirements in our contracts with third-party service providers and endeavor to require them to adhere to specific security standards and protocols.

companyName: OIL STATES INTERNATIONAL, INC

ticker: OIS


text: management and strategy have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is aligned to the Company's business strategy and shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;

companyName: Jingbo Technology, Inc.

ticker: SVMB


text: The board of directors receives briefings from management periodically on our cyber risk management program and presentations on cybersecurity topics as part of the board of directors' continuing education on topics that impact public companies.

companyName: Arteris, Inc.

ticker: AIP


text: internal and external assessments, including audits and response simulations, to examine cybersecurity vulnerabilities and potential attack vectors to company systems, as well as evaluating the impact of these vulnerabilities in our operational and financial posture.

companyName: AerSale Corp

ticker: ASLE


text: Our cybersecurity program is staffed by a team of highly skilled cybersecurity professionals, including over 24 dedicated internal cybersecurity resources. Four members of the security team currently have Certified Information Systems Security Professional (CISSP) credentials, many hold one or more Global Information Assurance Certification (GIAC)/The Sans Institute (SANS) cybersecurity certificates, and in total the team has over 70 security and network certifications. Our response team members are in various global locations to ensure 24/7 monitoring and response capabilities and are backed by a 24/7 Managed Security Services Provider (MSSP) who monitors cybersecurity alerts. The program incorporates industry standard frameworks, policies and practices designed to protect the privacy and security of our sensitive information, backed by a suite of best-in-class security technologies and tools to implement and automate security protections for our networks, employees, and customers.

companyName: Crane Co

ticker: CR


text: The CISO chairs an Information Security Committee made up of other risk professionals, Information Technology and line of business leaders to maintain an understanding and balance between security and business functionality.

companyName: FNB CORP/PA/

ticker: FNB


text: The CIEC is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIEC's expertise includes a combined 20 plus years of experience in managing security technologies; designing and implementing security strategies; and risk management and incident response across various industries. Our CIEC supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: QUANTUM CORP /DE/

ticker: QMCO


text: Our Board of Directors maintains oversight responsibility for how we manage risk, and it charges management with assessing and mitigating that risk through the development, implementation and maintenance of our risk management processes including our cybersecurity program. Our internal audit department, which reports to the Audit Committee, administers our enterprise risk assessment and, in coordination with our legal and compliance functions, is responsible for ongoing enterprise risk management assessments. Our internal audit department also regularly reports to the Board of Directors and its committees on risk-related issues.

companyName: Mueller Water Products, Inc.

ticker: MWA


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plan; information security program; acceptable use policy; incident detection and response tools; risk assessments of certain environments and systems; encryption of certain data; network security for certain environments and systems; access controls for certain environments and systems; data segregation of certain data; physical security; asset management; third-party systems monitoring; employee cybersecurity training; and cybersecurity insurance.

companyName: Vera Therapeutics, Inc.

ticker: VERA


text: Although we have never experienced a material information security breach nor have we incurred any expenses related to such a breach, we take a proactive approach to managing information security risk. Our process for managing existing and new service providers evaluates the degree to which such service providers will interface with our systems. This process dictates minimum insurance requirements and increased security documentation and protocols as interaction with our systems increases. We also have a cybersecurity awareness training program which includes annual required online training, periodic updates, notices, and reminders, and bi-weekly simulated phishing attacks with required remedial training for failures. Further, we have a documented business continuity plan that is updated and tested on an annual basis and we carry an information security risk insurance policy.

companyName: Piedmont Realty Trust, Inc.

ticker: PDM


text: Role of the Board The Audit and Finance Committee of the Board of Directors is responsible for the primary oversight of our information security programs, including relating to cybersecurity, and are integrated into the Company's Cybersecurity Incident response process. Our chief operating officer is responsible for reporting to the Audit and Finance Committee on our incident response plan, which includes an evaluation of cyber risks and threats, and notifies the Audit and Finance Committee of a cybersecurity threat. In the event of an incident, the Audit and Finance Committee reviews and approves the material incident disclosure plan and recommendation for determination of materiality using the guidelines approved by the Audit and Finance Committee. The Board of Directors and Audit and Finance Committee receive regular updates throughout the year on cybersecurity.

companyName: Comstock Inc.

ticker: LODE


text: Our cybersecurity program encompasses a comprehensive framework that begins with a clear governance structure lead by our Chief Technical Officer (CTO). Our CTO has spent over twenty-five years in the technology industry specializing in information security, cloud transformation, business intelligence and infrastructure. His cybersecurity experience includes having founded and managed a technology security and infrastructure consulting business catering to Fortune 500 companies.

companyName: Lazydays Holdings, Inc.

ticker: GORV


text: Risks from Cybersecurity Threats As of February 18, 2025, we were not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial standing. However, there can be no assurance that our cybersecurity processes will prevent or mitigate cybersecurity incidents or threats and that our efforts will always be successful. For further discussion regarding our cybersecurity risks, see "Risk Factors—General Risk Factors—A cyber incident could occur and result in information theft, data corruption, operational disruption or financial loss."

companyName: Matador Resources Co

ticker: MTDR


text: The Company established a governance committee to provide governance and oversight of security and compliance related activities for physical security and IT in support of their effective and efficient management of risks, strategies, and operational imperatives for the Company. The committee is chaired by our Senior Vice President and Chief Information Officer and the membership includes a cross-functional team of executives from IT/cybersecurity, operations, human resources, customer service, commercial, risk and insurance, finance, and the legal department. The committee is structured to cultivate collaboration across the enterprise and to align and prioritize resources with our strategic plan.

companyName: ONE Gas, Inc.

ticker: OGS


text: The Company maintains a commitment to cybersecurity using a combination of policy, technology, and training across the corporation. Emerging threats and regulatory compliance require regular monitoring and maintenance of the information technology environment, which the Company accomplishes by using internal resources, contracted partners, and industry-standard practices to meet security goals. These include implementation of technical controls such as National Institute of Standards and Technology ("NIST") SP 800-53 and NIST SP 800-171, and adherence to guidelines including Sarbanes-Oxley and the U.S. Department of Defense Federal Acquisition Regulation Supplement ("DFARS"). To address the risks to our information technology systems and data and as part of our Corporate Enterprise Risk Management program, we manage an information security program, which is designed to comply with the Department of Justice's CMMC requirements, maintain strong incident reporting capabilities and perform daily off-site backups. Additionally, we have implemented business continuity plans and security precautions for our critical systems, including establishing a back-up data center.

companyName: KAMAN Corp


text: Our CIO and CISO are also responsible for approving cybersecurity budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Veritone, Inc.

ticker: VERI


text: We recognize the importance of developing, implementing, and maintaining processes for assessing, identifying and managing material risks from cybersecurity threats.

companyName: HURCO COMPANIES INC

ticker: HURC


text: We have experienced security incidents in the past, which we believe were immaterial and were not reportable under applicable state law or our other obligations; however, there can be no assurance that our determinations were correct. We do not believe there are material risks from cybersecurity threats, including as a result of previous incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: Leafly Holdings, Inc. /DE


text: The board, as a whole and through its committees, has responsibility for oversight of risk management. In its risk oversight role, the board of directors has the responsibility to satisfy itself that the risk management processes designed and implement by management are adequate for identifying, assessing, and managing risk. The audit committee of the board of directors of the Company is responsible for oversight of risks from cybersecurity threats.

companyName: Knife River Corp

ticker: KNF


text: Our teams conduct vendor risk assessments of third-party suppliers that may receive access to personal data or connectivity to Wyndham's systems, for which such vendor risk assessments include information security control assessments and privacy impact assessments, regardless of the sensitivity of personal data potentially involved. The teams conduct similar internal assessments should any process potentially result in a significant change to the Company's data processing practices concerning sensitive data, or have a potentially material impact on individuals' data and respective rights.

companyName: WYNDHAM HOTELS & RESORTS, INC.

ticker: WH


text: Identifying and assessing cybersecurity risk as well as protecting us and our businesses from such risk is integrated into our overall risk management systems and processes as well as specifically addressed in our enterprise-wide cybersecurity program. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including threat intelligence collaboration and advisory mediums, third-party due diligence and risk assessments when determining the selection, oversight and engagement of third-party service providers, application security evaluations and annual penetration tests as well as management risk and compliance reviews. The foregoing combines with periodic review and analysis of third-party service provider system and organizational controls, internal network intrusion prevention systems, vulnerability assessments, access management, data loss prevention, remote access control, mandatory cybersecurity awareness training and random phishing campaigns with additional requisite training, if applicable, to identify and protect against cybersecurity risk.

companyName: CNL Strategic Capital, LLC


text: At the Board level, our cybersecurity practices are overseen by the audit committee as part of its oversight of our risk management activities. The committee meets periodically with, among others, our internal auditor and network administrator to review and discuss cybersecurity matters.

companyName: BRT Apartments Corp.

ticker: BRT


text: We utilize several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage material risks from cybersecurity threats, and to protect against, detect and respond to cybersecurity incidents (as defined in Item 106(a) of Regulation S-K), including, among others, the following: • maintain a global Security Operations Center to support visibility to cybersecurity incidents in real time; • require all salaried employees to complete an annual cybersecurity training program where specific threats and scenarios are highlighted based on our analysis of current risks to the organization; • provide regular cybersecurity awareness and confidential information protection training and conduct phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • maintain a Cybersecurity Incident Response Plan, which provides a framework for handling cybersecurity incidents based on, among other factors, the potential severity of the incident and facilitates cross-functional coordination of our response to such incidents, should they occur; • maintain cybersecurity insurance and regularly review our policy and levels of coverage based on current risks; • monitor emerging data protection and cybersecurity laws, and implement changes to our processes and systems designed to comply, and through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; • conduct several cyber-specific penetration tests per year; and • engage consultants and other third parties, as appropriate, in connection with our cybersecurity practices.

companyName: Babcock & Wilcox Enterprises, Inc.

ticker: BW


text: We depend on digital technologies, including information systems, infrastructure and cloud applications and services, including those of third parties with which we may deal. Sophisticated and deliberate attacks on, or security breaches in, our information systems or infrastructure, or the information systems or infrastructure of third parties or the cloud, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with the cybersecurity incident. As an early-stage company without significant investments in data security protection, there can be no assurance that we will have sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have adverse consequences on our business and lead to financial loss.

companyName: Aldel Financial II Inc.

ticker: ALDF


text: Our cybersecurity risk management framework includes (1) procedures designed to assess the data privacy and cybersecurity practices of third-party vendors and service providers (including risk assessments and contractual protections), (2) technical IT controls designed to manage risks associated with cybersecurity incidents (such as multifactor authentication and requirements for VPN or private channel access to our systems), and (3) formal policies and procedures designed to address cybersecurity incidents. Our formal policies and procedures designed to address cybersecurity incidents include steps for verifying and assessing the severity of a cybersecurity incident, identifying the source of a cybersecurity incident (including whether it is associated with a third-party service provider) and implementing cybersecurity countermeasures and mitigation strategies. Additionally, we have procedures for informing senior management and our Board of Directors of potentially material cybersecurity incidents. We also periodically engage third-party security consultants to assess our cybersecurity program and to perform penetration testing on our security environment and controls. In addition, cybersecurity training is provided to all newly hired colleagues and then at least annually for all colleagues. We also conduct regular ongoing cybersecurity awareness campaigns and phishing tests and provide training in response to such tests as appropriate.

companyName: MARSH & MCLENNAN COMPANIES, INC.

ticker: MRSH


text: Overall, we devote resources to network security, data encryption, employee training and other measures to protect our systems and data from unauthorized access or misuse. This includes the emerging need to protect our data from the unauthorized incorporation in large language models or other artificial intelligence systems. The Audit Committee and full Board of Directors receive quarterly reports on cybersecurity risks and annual reports on management initiatives to promote cybersecurity.

companyName: AXCELIS TECHNOLOGIES INC

ticker: ACLS


text: Program Overview maintain, routinely review and evaluate our information technology and cybersecurity policies, practices and procedures (our "Cybersecurity Program"). The Cybersecurity Program has various policies and procedures, including an Information and Cybersecurity Policy and Business Continuity/Disaster Recovery Plan. Our Cybersecurity Program is administered by our Information Security Committee, which consists of our Chief Financial Officer, Chief Compliance Officer and other Company management and counsel, as appropriate, all of which is subject to the oversight of our Board of Directors. We also utilize the services of information technology and cybersecurity advisers, consultants and experts in the evaluation and periodic testing of our information technology and cybersecurity systems to recommend improvements to our Cybersecurity Program and in connection with any cybersecurity incident. We believe that the individuals involved in our Cybersecurity Program possess the necessary skills, experience and backgrounds that, when combined with the resources of our external information technology and cybersecurity advisers, consultants and experts, are sufficient to manage our Cybersecurity Program.

companyName: SURO CAPITAL CORP.

ticker: SSSS


text: Given the importance of cybersecurity to our business, we maintain a cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of administrative, physical and technical safeguards, including contracted 24/7/365 Security Operating Center monitoring services and alerting systems for internal and external threats; regular evaluations of our cybersecurity program, including periodic internal and external audits; and industry benchmarking. We also require cybersecurity trainings when onboarding new employees and conduct ongoing cybersecurity awareness testing for our employees. Our program leverages industry frameworks, including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) to strengthen our program effectiveness and reduce cybersecurity risks.

companyName: Perspective Therapeutics, Inc.

ticker: CATX


text: The Company is subject to cybersecurity risks related to its business partners and third-party service providers, as further detailed under the heading "Increasing privacy, data security and cybersecurity obligations or a significant data breach may adversely affect the Company's business" included as part of the risk factor disclosures in Part I, Item 1A. of this report. To manage these risks, the Company considers the impact of third-party incidents as part of its cybersecurity incident response processes. The Company also conducts evaluations of key suppliers based on risk and seeks to incorporate appropriate security standards to manage the risk. The Company also regularly monitors the external cybersecurity posture of select third parties through various service providers.

companyName: United Airlines Holdings, Inc.

ticker: UAL


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program/information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and enhance our practices. We engage certain external parties, including consultants, independent privacy assessors, computer security firms and risk management, peer companies, industry groups and governance experts, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect our company from any related vulnerabilities.

companyName: Beam Therapeutics Inc.

ticker: BEAM


text: Cyber Risk Management and Strategy We have adopted processes for assessing, identifying, and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cybersecurity threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, and periodic review of our procedures in an effort to identify risks and refine our practices. To support our internal resources, we leverage external tools and resources, including a managed service provider that provides ongoing support for the protection of our information technology infrastructure.

companyName: Upstream Bio, Inc.

ticker: UPB


text: Our cybersecurity incident response plan includes retention of external experts for prompt assistance following discovery of any material incident. This cybersecurity incident response plan is part of our ongoing cybersecurity vulnerability management, and we endeavor to maintain appropriate controls to identify, monitor, analyze and address potential cybersecurity incidents, including potential unauthorized access to our networks and applications, along with detection of potential unusual activity within our networks or applications. Any potential cybersecurity incident is immediately reported the Chief Executive Officer and Chief Financial Officer, and the Audit Committee or the full Board, as appropriate.

companyName: CRAWFORD UNITED Corp