text: Security Awareness and Training – The Company established a security awareness program that focuses on individual employees' impact to the overall security strength of the company. Via the use of web-based and in person training, surveys and published literature, the Company is constantly making the employees aware of the vital role they play in protecting both the Company and customers' data. Phishing exercises are also periodically conducted to improve employee knowledge of and response to security threats. Specialized web-based training covering Payment Card Industry ("PCI"), Health Insurance Portability and Accountability Act ("HIPAA") and Federal Tax Information is also required and tracked for employees who have access to that data.

companyName: CINCINNATI BELL INC


text: In early 2024, Standard BioTools completed a merger with SomaLogic. Critical to integration activities has been a wholesale review of policies, procedures and tools relevant to the combined cybersecurity environment with the objective of deploying and maintaining those which serve to reinforce our security presence to the greatest extent. While these activities continue, it has been noted that the SomaLogic organization takes a comparable, if not more stringent, approach to their cyber and information security posture inclusive of their ongoing ISO 27001 compliance certification.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB

secItem: Item 1C


text: If the severity is assessed as Low or Medium in accordance with criteria identified in the incident response and recovery plans, the Response Coordinator will report the incident to the CISO and complete the remediation actions for the cybersecurity incident and report the final outcome to the CISO. The CISO will report to the ERT remediation of Low or Medium cybersecurity incidents at least on a quarterly basis. If the cybersecurity incident is classified as a High, or at the Response Coordinator's discretion, the Response Coordinator will report the cybersecurity incident to the CISO and promptly convene the ERT. The ERT will determine the appropriate steps necessary to respond to the cybersecurity incident and oversee the MRT's execution of the response. The ERT will determine whether the cybersecurity incident needs to be escalated to the Board.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: Cibus has established procedures to identify, assess, and manage risks across the business, including risks related to cybersecurity. The Company's cybersecurity strategy includes risk management methodologies and analytics, which are designed to facilitate cyber resilience, minimize attack surfaces, and provide flexibility and scalability in its ability to address cybersecurity risks and threats. Organizational risk assessments help management to assess threats and identify and investigate potential vulnerabilities to make risk management decisions and assign resources to mitigate risk. The Company's cybersecurity risk management strategy is incorporated into its business continuity plans, which include plans designed to address disaster recovery at its data centers and its holistic risk assessment procedures. Further, Cibus has a security awareness platform that provides its employees training on a variety of topics.

companyName: Cibus, Inc.

ticker: CBUS


text: We regularly engage third parties to test, maintain, and enhance our cybersecurity risk management practices and threat monitoring. These engagements include incident response exercises, penetration testing, constant managed detection and response services, and intrusion prevention and detection applications. Our vendor risk management program includes regular reviews and oversight of these third parties, including performance and technological reviews and escalation of any unsatisfactory performance, in order to identify, prioritize, assess, mitigate and remediate third party risks. However, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: Federal Home Loan Bank of Cincinnati


text: Our risk assessment efforts have indicated that we are a target for theft of intellectual property, financial resources, personal information, and trade secrets from a wide range of actors including nation states, organized crime, malicious insiders and activists. The impacts of attacks, abuse and misuse of Pfizer's systems and information could include, without limitation, loss of assets, operational disruption and damage to Pfizer's reputation.

companyName: PFIZER INC

ticker: PFE


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities. The Board of Directors receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually. Additionally, on a quarterly basis, the Audit Committee will receive updates from Management on cybersecurity.

companyName: Ascent Solar Technologies, Inc.

ticker: ASTI


text: Our IT risk program also includes an incident response plan that provides procedures for how we detect, respond to and recover from cybersecurity incidents, which include processes designed to triage, assess severity, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: MSCI Inc.

ticker: MSCI


text: We have an enterprise-wide cybersecurity strategy that focuses on implementing risk-based controls, technologies, and other processes. We aim to incorporate industry best practices throughout our cybersecurity program, including the frameworks established by the National Institute of Standards and Technology ("NIST"), the Cybersecurity and Infrastructure Security Agency ("CISA"), and other applicable industry standards. To augment our in-house capabilities, we leverage expertise from professional services firms and/or outside counsel, as needed, to assess our cybersecurity controls, and collaborate on an ever-changing landscape. Our cybersecurity program is verified as conforming with ISO/IEC 27001:2013 and our most recent recertification was in 2023.

companyName: Huron Consulting Group Inc.

ticker: HURN


text: Our Board of Directors has overall oversight responsibility for our ERM program, including oversight of cybersecurity risk management. The Board administers its risk oversight function through the full Board and its standing committees. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks and implement processes and programs to manage such risks and mitigate cybersecurity incidents. Management, including the Chief Information Officer ("CIO"), updates the Audit Committee on at least an annual basis regarding our cybersecurity programs and material cybersecurity risks and mitigation strategies. In addition, we have a standardized incident response process that establishes procedures for timely escalation and notification to the ISPEC and other members of senior management.

companyName: RADIUS RECYCLING, INC.


text: deployment of third-party cybersecurity experts to perform penetration testing on our internal and external networks and systems in an of the cybersecurity risks posed by interacting with current and potential third-party service providers, suppliers and customers.

companyName: AIR INDUSTRIES GROUP

ticker: AIRI


text: Where appropriate, we engage reputable third-party vendors to provide cybersecurity-related services, including security monitoring, risk evaluations, penetration testing, audit, and incident response services, which are aligned with internationally accepted frameworks. Our vendors are selected based on specific due diligence activities, such as evaluations of controls, policies, and processes of such vendors for protecting data, and resolving incidents, as well as entering into written contracts with such vendors that include terms addressing data security, privacy, and incident response expectations, responsibilities and liabilities, and termination rights of the parties. We routinely monitor vendor performance, review compliance with contract terms, and address concerns.

companyName: FTI CONSULTING, INC

ticker: FCN


text: As part of the above processes, we regularly engage with assessors, consultants, auditors, and other third parties, including by regularly conducting technical and data reviews with our cybersecurity partners to help identify areas for continued focus, improvement and/or compliance.

companyName: Marcus & Millichap, Inc.

ticker: MMI


text: Monitoring and Responding to Cybersecurity Incidents The security organization stays informed about the latest developments in cybersecurity, implements processes for regular monitoring of information systems and deploys relevant security measures. In the event of a cybersecurity incident, a formal incident response plan is in place for immediate actions and long-term strategies.

companyName: NORDSTROM INC


text: Risk Management Reporting The IT Team provides updates to upper Management on a routine basis or as potentially critical risks from cybersecurity threats or incidents arise. In addition, the audit committee is notified of any material cybersecurity concerns that may impact internal controls, data storage, or the integrity of our financial reporting.

companyName: AppTech Payments Corp.

ticker: APCX


text: To support incident response preparedness, the Company has developed a cybersecurity incident response plan and conducts an annual simulated incident exercise. The cybersecurity incident response plan addresses cybersecurity incidents that directly impact the Company or arise from the Company's use of third-party technology, information systems, and service providers. The Company also utilizes business continuity and disaster recovery plans to prepare for potential disruptions in technology that the Company relies upon. Further, the Company monitors novel and advanced cybersecurity threats and provides ongoing employee security awareness training.

companyName: Spectrum Brands Holdings, Inc.

ticker: SPB


text: Our Head of Information Security, Governance, Risk and Compliance is CISA certified and has over 20 years of leadership experience in IT audit and governance, risk and compliance ("GRC") at companies like Google, Cisco, Federal Reserve Bank, & Vodafone. They have substantial expertise in implementing SOX compliance, NIST compliance, COSO / COBIT framework, GDPR compliance, privacy compliance, regulatory compliance, internal IT audit, ITIL/ ITSM standards and risk assessment. Additionally, they have established our enterprise risk management program and leads our infosec steering committee. They have also been instrumental in automating GRC and continuous control monitoring to drive efficiency at our company.

companyName: Velo3D, Inc.

ticker: VELO


text: We have an Incident Response Plan ("IRP") that defines and documents procedures for assessing, identifying, and managing a cybersecurity incident. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process aligns with the NIST framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all personnel (including third-party partners) that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company. We also have protocols by which material cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Board of Directors.

companyName: Calumet Specialty Products Partners, L.P.


text: We understand the importance of cybersecurity in maintaining the confidentiality, integrity and availability of our systems and data. In order to protect against increasingly sophisticated cybersecurity threats, we have developed, implemented and maintained policies, procedures, and controls to mitigate material risks from cybersecurity threats, including robust protocols for the assessment of information concerning material cybersecurity incidents and the disclosure of such information to investors. These risks are evaluated on an ongoing basis as part of our overall risk management strategy. As discussed in more detail below, we have policies and procedures in place to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, train and raise awareness of cybersecurity threats amongst employees, detect intrusions into our systems, and respond to cybersecurity incidents. Despite these efforts, no system is impenetrable, and we cannot provide assurances that we will timely identify or prevent every cybersecurity attack or incident.

companyName: FARMER BROTHERS CO

ticker: FARM


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management activities. Cybersecurity risks are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.

companyName: Solaris Energy Infrastructure, Inc.

ticker: SEI


text: The Vice President for Information Systems is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Vice President for Information Systems is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: DBV Technologies S.A.

ticker: DBVT


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. However, to date, cybersecurity threats have not materially affected us, including our business strategy, results of operations, or financial condition. We identify nation state-sponsored threat actors and the rise in sophistication and proliferation of criminal cyber threat actors and ransomware campaigns as top reasonable material risks to the business. The theft, unauthorized use or publication of our intellectual property and/or confidential business or personal information (whether through a breach of our own systems or the breach of a system of a third party that provides services to us) could harm our competitive or negotiating positions, reduce the value of our investment in research and development and other strategic initiatives, compromise our patent enforcement strategies or outlook, damage our reputation or otherwise adversely affect our business. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: InterDigital, Inc.

ticker: IDCC


text: We further monitor, test, assess, and update these processes, including working with technology partners, government agencies, regulators, law enforcement, industry groups, and peers to implement practices to guard against an evolving cyber threat environment and to ensure we remain compliant with relevant regulatory requirements. We offer cybersecurity training for staff at key sites, focusing on reducing human risk through anti-phishing and social engineering exercises. We also carry cybersecurity insurance that provides protection against potential losses arising from certain cybersecurity incidents as part of our cybersecurity risk mitigation strategy.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: The Security Committee, which is composed of all of our independent directors, facilitates our board of directors' responsibility for oversight of security matters, including product security, data security, cybersecurity, security risk management, risk exposure and related controls and enterprise risk management related to these risks. The Security Committee reports regularly to the Board following meetings of the Security Committee with respect to its review and assessment of security matters and other matters that are relevant to the Security Committee's discharge of its responsibilities. The Security Committee meets quarterly to review with our chief information security officer and other members of management, which may include our chief executive officer, chief product officer, chief financial officer, and general counsel, our cybersecurity programs, cybersecurity risks, mitigation or remediation strategies, and other matters impacting the committee's responsibilities.

companyName: Palo Alto Networks Inc

ticker: PANW


text: The Nominating and Governance Committee receives periodic reports from our CISO and Information Security Steering Committee concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them. The Nominating and Governance Committee also has access to the various historical reports, summaries and presentations prepared by the Information Security Steering Committee related to cybersecurity threats, risk and mitigation.

companyName: Enovix Corp

ticker: ENVX


text: Our CISO manages the Company's cybersecurity compliance program, including prevention, mitigation, detection and remediation of cybersecurity incidents. Our CISO, who reports directly into the CIO, has over 30 years of experience in information technology and cybersecurity and holds multiple industry certifications.

companyName: TAPESTRY, INC.

ticker: TPR


text: The audit committee of our board of directors is responsible for oversight of the Company's cybersecurity and other information technology risks, controls and procedures, including the Company's plans to mitigate cybersecurity risks and to respond to data breaches. The audit committee receives quarterly updates on our Cybersecurity Program from our Chief Technology Officer ("CTO") at its regularly-scheduled committee meetings or more frequently as needed. The chair of the audit committee then briefs the full board of directors on matters covered at the audit committee meeting, including cybersecurity matters.

companyName: Shapeways Holdings, Inc.


text: In an effort to prevent and detect cyber threats, the Company annually provides all employees, including part-time and temporary, with cybersecurity and privacy training, which covers timely and relevant topics, including social engineering, phishing, password protection, data protection, physical security, and educates employees on the importance of reporting all incidents immediately.

companyName: CHOICE HOTELS INTERNATIONAL INC /DE

ticker: CHH


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers. We set clear objectives for third-party service providers, and we assess cybersecurity practices and any history of security incidents before engaging any potential service providers. Our contracts explicitly include requirements relating to cybersecurity, including adherence to certain standards, to ensure compliance with our security protocols. Once engaged, we regularly monitor the cybersecurity posture of major providers through log reports and intelligent threat protection analysis.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: Likewise, logical access controls are employed to manage and provision access based upon business need, and data encryption is leveraged to preserve data confidentiality. Data is regularly backed up in support of preserving availability. Audit logs are collected, correlated and analyzed by the Security Operations Center ("SOC").

companyName: Aramark

ticker: ARMK


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. "Risk Factors" in this Annual Report on Form 10-K, including the section titled "Risks Related to Information Technology and Intellectual Property."

companyName: Vital Farms, Inc.

ticker: VITL


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training that is provided to our employees and contractors, including those who are involved in incident response]; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • assessment of cybersecurity risks posed by third parties, including current and potential collaborators, service providers, suppliers, vendors and other contractual counterparties, in each case, to the extent they have access to our critical systems or information.

companyName: Revolution Medicines, Inc.

ticker: RVMD


text: Detailing the integration of cyber risk into our risk management, cybersecurity risk is addressed as a crucial component of our enterprise risk management program. The IT department works in close collaboration with executive management to prioritize risk management processes, with a particular focus on mitigating cybersecurity threats that could have a significant impact on our business. Furthermore, team members from the IT department or a relevant executive committee evaluate material risks from cybersecurity threats in alignment with our overall business objectives. These evaluations are then communicated to the audit committee of the board of directors. The audit committee assesses these risks as part of our overall enterprise risk, ensuring that cybersecurity is given due consideration in line with our strategic goals and governance framework.

companyName: Cidara Therapeutics, Inc.


text: We have committees, response and management teams, and dedicated positions for managing and assessing cybersecurity risk, including a Chief Information Security Officer, a Chief Risk Officer, an Enterprise Risk Management Committee, Computer Security Incident Response Team, Cyber Crisis Management Team, and a dedicated internal information security team. Our Chief Information Security Officer and Chief Risk Officer have extensive experience in the industry. Our Chief Information Security Officer has over a dozen years of experience leading information security programs including, experience in cybersecurity consulting, leading strategy and the implementation of cyber defenses for several of the top online retailers in the United States, as well as serving as Chief Information Security Officer for Cboe Digital Exchange and Cboe Clear U.S. Our Chief Information Security Officer is currently responsible for developing and executing the Company's global security strategy and roadmap along with its long-range plan to meet industry and regional regulatory compliance requirements. We have an information security department with associates who are located around the globe. Our Chief Risk Officer's tenure with Cboe spans 24 years, during which time he has held senior positions in information security and risk management. He is currently responsible for oversight of the Company's risk function including the enterprise risk management, information security, privacy, vendor management, and IT asset management programs.

companyName: Cboe Global Markets, Inc.

ticker: CBOE


text: Qualifications. We view cybersecurity as a shared responsibility. To that end, the members of our Cybersecurity Committee represent a range of functions from across our company, including our property information technology directors, Corporate Controller, Vice President of Internal Audit and Compliance, Corporate Secretary and General Counsel, and the Western Director of Finance. This group has primary responsibility for assessing and managing material cybersecurity risks. The combined experience of this group consists of approximately 14 decades of direct information technology leadership experience, in addition to multiple degrees and specialized training and certifications in the information technology and cybersecurity field. External Assessments. We engage independent third parties to conduct external vulnerability and penetration testing.

companyName: FULL HOUSE RESORTS INC

ticker: FLL


text: Our Senior Director leads our internal team responsible for assessing and managing cybersecurity risks. The Senior Director has more than 10 years of experience being responsible for cybersecurity at multi-site industrial companies, in addition to IT infrastructure and strategy, and has earned the Global Information Assurance Certification ("GIAC") Critical Controls, Defensible Security Architecture, Security Leadership, Security Operations, and Strategic Planning, Policy and Leadership certifications, as well as a Cybersecurity Management degree from the SANS Technology Institute. The Senior Director reports directly to the General Counsel and regularly engages with and briefs other members of senior and executive management on cybersecurity issues. A number of IT professionals with experience implementing cybersecurity defenses and responding to cyber attacks report to the Senior Director and, as noted above, the Senior Director also oversees third-party firms specializing in security monitoring and vulnerability assessment.

companyName: Coeur Mining, Inc.

ticker: CDE


text: Our Sponsor engages third-party consultants in connection with their and our cybersecurity program for assessing, identifying and managing material risks from cybersecurity threats. These third parties provide testing and advisory services to identify risks, improve the quality of controls, and respond to cybersecurity incidents.

companyName: JLL Income Property Trust, Inc.


text: In order to mitigate data or security incidents that may originate from third party vendors or suppliers, we conduct both privacy and security assessments to properly identify, prioritize, assess and remediate any third party risks, and require security and privacy addenda to our contracts where applicable.

companyName: 1stdibs.com, Inc.

ticker: DIBS


text: We rely on our technology infrastructure and information systems to interact with suppliers, sell our products and services, fulfill orders, support our customers, and bill, collect, and make payments. Our internally developed system and processes, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats, such as terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, or other security breaches. Such attacks have become more and more sophisticated over the years and in some cases have been conducted or sponsored by governmental actors with significant means. We have implemented robust processes to assess, identify, and manage cybersecurity risks, including potentially material risks, related to our internal information systems, our products, and our business. Our Board of Directors has direct oversight of our enterprise risk management process, including the management of cybersecurity risks, as described below.

companyName: METTLER TOLEDO INTERNATIONAL INC/

ticker: MTD


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Security Officer and Chief Privacy and Information Risk Officer. Such individuals have collectively over 40 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. They also have several relevant degrees and certifications, including Certified Information Security Manager, Certified Information Systems Auditor, Certified Information Systems Security Professional, Global Information Assurance Certification, and Certified Professional Hacker.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: Incident Management Plan Our cybersecurity incident management plan comprises the following six-step process: • The Service Center's Chief Information Officer and Director of Information Security lead its ISO team in the development, documentation, review and testing of security procedures and incident management procedures. Beyond initial creation, procedures are continually re-assessed, updated and tested on an ongoing basis. • The ISO team works with the Executive Team on the identification, assessment, verification and classification of incidents to determine affected stakeholders and appropriate parties for contact. • The Service Center's Chief Information Officer and Director of Information Security are responsible for launching the Incident Response Team (IRT) if necessary and for notification to the Executive Team, who in turn will contact the Board of Directors and the Audit Committee to validate that the response is being addressed appropriately. • The IRT, in consultation with outside experts if needed, is responsible for the following: • Initial containment by making tactical changes to the computing environment to mitigate active threats based on currently known information. • Analysis to establish the root cause of incidents, identification and evidence collection from all affected machines and log sources, threat intelligence and other information sources. Once all appropriate information has been collected, we perform a careful analysis using forensically-sound tools and methods to prevent any contamination of evidence. • Incident containment by further analyzing additional information and further identifying any additional compromised machines or resources not previously identified. • Incident eradication by re-assessing the root cause of incidents where solutions are then implemented to solve underlying problems and prevent re-occurrence. • Recovery and restoring normal business functionality, which includes the reversal of any damage caused by the incident and responding as necessary. • Review after closure of each incident and conducting a lessons learned analysis to improve prevention and help to make incident response processes more efficient and effective. Also, the IRT evaluates competency and any additional training requirements needed. A final incident report will then be provided to key stakeholders and IRT members, which includes, but is not limited to the summary of the incident and its impact, a timeline of events, a detailed description of the incident, an evaluation of the organizational response and an assessment of the damages.

companyName: ENSIGN GROUP, INC

ticker: ENSG


text: We are constantly evolving our cyber defenses to minimize impacts from cyber threats by using a multi-pronged approach that helps safeguard our assets and data. We are particularly focused on addressing emerging cybersecurity risks, including human risk, as phishing attacks remain one of the most common causes of data breaches; third-party supply chain risks, as threat actors continue to target supply chains to compromise a greater number of victims; and geopolitical risk, as tensions and conflicts around the world are often accompanied by an increase in sabotage, espionage and cyber attacks. As threat actors frequently target employees to gain access to information and systems, we have a comprehensive global human risk management program that educates our workforce on threats they face as a first line of defense, and includes elements addressing phishing, malware, data handling, device security, cybersecurity education, password security, internet browsing and defenses to physical threats. Our employees are exposed to data-driven cybersecurity awareness campaigns and training in order to keep pace with industry standards, evolving challenges and innovative solutions with respect to information security, data privacy, and cybersecurity risks to the organization. Additionally, we employ a multi-layered approach in our application of cybersecurity technologies to help safeguard our systems, networks, and data from potential cybersecurity threats. For companies that we acquire, our integration plans include, where appropriate, workable timelines for alignment on information security, data privacy, cybersecurity and employee education.

companyName: BRISTOL MYERS SQUIBB CO

ticker: BMY


text: Although we have implemented a cybersecurity program designed to protect and preserve the confidentiality, integrity and availability of our information systems and assets, the Company also maintains cybersecurity insurance to manage potential liabilities resulting from specific cyber incidents. However, it is important to note that although we maintain cybersecurity insurance, there can be no guarantee that the insurance will cover the Company, wholly or partially, from potential liabilities, or that such insurance proceeds will be paid to us in a timely manner.

companyName: Third Harmonic Bio, Inc.


text: In 2023, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Part I. Item 1A. Risk Factors—Risks Related to Our Business and Operations—Cybersecurity risks and cyber incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and confidential information in our possession and damage to our business relationships." and "Part I. Item 1A. Risk Factors—Risks Related to Our Business and Operations—Increased data protection regulation may result in increased complexities and risks in connection with the operation of our business and products."

companyName: Blue Owl Real Estate Net Lease Trust


text: Our Integrated Information Security Framework ("IISF") defines the policies and processes we have in place to safeguard proprietary and confidential information. Our IISF is based on relevant industry frameworks and laws, including, but not limited to National Institute of Standards and Technology ("NIST"), Good Practices Quality Guidelines (GxP), Health Information Trust Alliance (HITRUST), the ISMS Family of Standards (ISO 27000 family), Control Objectives for Information Technologies (COBIT), the EU General Data Protection Regulation (GDPR), and the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The framework consists of policies, standards, procedures, work instructions and documentation. Information is classified into four categories to help individuals apply the right level of controls and safeguards to information, applications and systems. In 2023, we conducted a mapping with the NIST to align our procedures with industry standards in an effort to create a first-in-class approach. Our global data centers and IT controls are included in an annual SOC2 Type II attestation program carried out by an independent audit firm who performs control testing and issue reports. Our set of SOC2 controls is aligned with ISO 27001 specification and therefore provides an equivalent level of assurance on a global level. Additionally, our cybersecurity controls are regularly assessed as part of our global Internal Audit plan, and the maturity of our Information Security program is also regularly assessed on at least an annual basis with the help of independent consultants.

companyName: IQVIA HOLDINGS INC.

ticker: IQV


text: We have implemented and maintain various processes to identify, assess, prioritize, manage, and report on cybersecurity risks that could result in loss or other adverse consequences to Pure Storage. We maintain a variety of channels designed to identify risks, including risks associated with our use of third-party service providers, such as by conducting vulnerability assessments, reviewing audit findings, discussing with key stakeholders, and analyzing security incidents and reports from our employees and others.

companyName: Everpure, Inc.

ticker: PSTG


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Technology Officer ("CTO"), James Liao, to manage the risk assessment may engage consultants and other third parties as needed in connection with our risk assessment policies and processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.

companyName: Foxx Development Holdings Inc.

ticker: FOXX


text: Our business is highly dependent on our information systems, including our ability to operate them effectively and to successfully implement new technologies, methods and processes, as well as adequate controls and cybersecurity incident recovery plans. We rely on our information systems to manage our business, data, communications, supply chain, ordering, pricing, billing, inventory replenishment, accounting functions and other processes. In addition, we must protect the confidentiality and integrity of the data of our business, employees, customers and other third parties. Our business involves the collection, processing, storage and transmission of personally identifiable information and other sensitive and confidential information. This data is wide ranging and relates to our employees, customers and third parties, including the subjects of law enforcement. Our compliance obligations include those prescribed under the laws and regulations that dictate whether, how and under what circumstances we can receive, process, hold and/or transfer certain data that is critical to our operations, including data shared between countries or regions in which we operate and data shared among our products and services.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.

companyName: Arcellx, Inc.

ticker: ACLX


text: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner designed to address cybersecurity threats and events. The results of such assessments, audits, and reviews are evaluated by management and reported to the Audit Committee of the Board, or the Audit Committee, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: CareDx, Inc.

ticker: CDNA


text: Oversee Third-party Risk As part of our evolving cybersecurity roadmap, we plan to implement and conduct security assessments of all third-party service providers before engagement and maintain ongoing monitoring to ensure compliance with relevant cybersecurity standards.

companyName: electroCore, Inc.

ticker: ECOR


text: In an effort to reduce the likelihood and severity of cyber intrusions, Dominion Energy has a comprehensive cybersecurity program covering its operations, including DESC, designed to protect and preserve the confidentiality, integrity and availability of data and systems. Consideration of cybersecurity risks is a key component of Dominion Energy's overall risk management and integrated into processes such as evaluation of potential new vendors or suppliers. Dominion Energy is subject to mandatory cybersecurity regulatory requirements, interface regularly with a wide range of external organizations and participate in classified briefings to maintain an awareness of current cybersecurity threats and vulnerabilities.

companyName: DOMINION ENERGY SOUTH CAROLINA, INC.


text: Our cybersecurity team has also established Company-wide policies and procedures that cover cybersecurity matters, which are designed to enable us to effectively identify, evaluate, and respond to events that have the potential to impact our business. In the event of a cybersecurity incident, the Company utilizes a well-defined incident response plan that coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations (including relevant securities laws) and mitigate brand and reputational damage. This plan includes immediate actions to mitigate the impact, as well as long-term strategies for the remediation and prevention of future incidents. In accordance with this plan, we have established a cross-departmental Brighthouse Response Team that is responsible for coordinating enterprise-wide responses to cybersecurity incidents, as applicable. This Brighthouse Response Team provides reports regarding cybersecurity incidents to the enterprise-level risk committee referenced above.

companyName: Brighthouse Financial, Inc.

ticker: BHF


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors (the "Board") and management. Although cybersecurity risk oversight continues to remain a top priority for the Board, the Audit and Risk Committee of our Board has primary oversight responsibility for the Company's cybersecurity and other technology risks. The Committee regularly reviews with and discusses cybersecurity, privacy and data security programs, the status of projects to strengthen internal cybersecurity, results from third-party assessments, and any significant cybersecurity incidents, including recent incidents at other companies and the emerging threat landscape with our CISO and CCTO. The Committee also reviews with management the implementation and effectiveness of the Company's controls to monitor and mitigate cybersecurity risks. In addition, our Board receives an annual report and quarterly written updates regarding our cybersecurity program.

companyName: CHIPOTLE MEXICAN GRILL INC

ticker: CMG


text: As part of our cybersecurity program, we assess the cybersecurity posture of our third-party vendors and partners to ensure they meet our security standards. This includes due diligence during the vendor selection and periodic evaluations throughout our partnerships. Third-party risk management, compliance adherence, and the consideration of cyber insurance contribute to a holistic and proactive approach to cyber risk management. Regular reviews and updates to the program ensure its relevance and effectiveness in the face of emerging threats, fostering a culture of continuous improvement and resilience.

companyName: Lazydays Holdings, Inc.

ticker: GORV


text: Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks.

companyName: CarGurus, Inc.

ticker: CARG


text: Management is responsible for the day-to-day assessment and management of cybersecurity risks. Saia's Director of Information Security and Compliance, who reports to the Executive Vice President and Chief Information Officer, has primary oversight of our cybersecurity risk management and strategy processes. The Director of Information Security and Compliance has served in information security roles since 2001 and led the information security function for a large health care system prior to joining Saia. He has a Bachelor of Science degree in Information Technology with a Concentration in Information Assurance and Security.

companyName: SAIA INC

ticker: SAIA


text: If the cybersecurity team detects a potentially significant cybersecurity incident it is escalated promptly to the Company's head of cybersecurity, who then activates the Company's incident response plan and convenes the incident response team, which includes leaders of the Company's Legal, Finance, Operations, Communications, Risk Assurance, and other departments and executive leadership as appropriate. The Chief Executive Officer will inform the Company's Board of Directors of any material cybersecurity incidents.

companyName: GARMIN LTD

ticker: GRMN


text: Risk Management for Third-Party Providers: We conduct due diligence when selecting and periodically reviewing third-party service providers, suppliers, and vendors to ensure they comply with necessary cybersecurity standards.

companyName: LIGHTPATH TECHNOLOGIES INC

ticker: LPTH


text: Risk assessments designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment.

companyName: QUICKLOGIC Corp

ticker: QUIK


text: In addition, the Company's IT Steering Committee (ITSC) considers, among other IT matters, risks relating to cybersecurity and applicable mitigation plans to address such risks. The ITSC is comprised of certain members of the Company's senior management. The IT Director and Security Director attend each ITSC meeting. The ITSC generally meets quarterly during the year with the IT Director and Security Director to review risk mitigation activities as well as updated status of global security operations and metrics, including the prevention, detection, mitigation and remediation of cyber incidents. The IT Director, Security Director and ITSC monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in the cybersecurity risk management and strategy processes, including the operation of the Company's incident response plan. The Company has an established process led by our Security Director governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident.

companyName: IPG PHOTONICS CORP

ticker: IPGP


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, an incident response plan and policy, incident detection and response, vulnerability management policy, disaster recovery and business continuity plans, risk assessments, implementation of security standards and certifications, encryption of data, network security controls, access controls, physical security, asset management, tracking and disposal, systems monitoring, penetration testing, dedicated cybersecurity staff, vendor risk management program, and employee training. In addition, we maintain cybersecurity insurance.

companyName: Arlo Technologies, Inc.

ticker: ARLO


text: Our Board of Directors is responsible for the oversight of risks from cybersecurity threats. Our Chief Information Officer provides our Board of Directors quarterly reports that summarize material cybersecurity threats and the countermeasures taken to mitigate the associated risks. These reports address a variety of topics including updates on strategic cyber initiatives, industry trends, threat vulnerability assessments, and efforts to prevent, detect and respond to internal and external critical threats. From time to time, our Board of Directors also engages third-party consultants to provide further education about cybersecurity risks.

companyName: BLACK HILLS CORP /SD/

ticker: BKH


text: Management's Role in Assessing and Managing Materials Risks from Cybersecurity Threats Under the IRP, cybersecurity incidents are escalated based on a defined incident severity to management as appropriate. Management, including the CIO, is involved in assessing and managing our cybersecurity risks. Our CIO has 14 years of experience managing information technology in complex environments. As noted above, the company's IRP includes standard processes for escalating significant cybersecurity incidents to management, including the CIO, who then informs the Board based on the nature and severity of the incident. The company's incident response team also coordinates with external legal advisors, cybersecurity forensic firms, communication specialists, and other outside advisors and experts, as appropriate.

companyName: Twist Bioscience Corp

ticker: TWST


text: Our vice president of information security leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare our company and our employees to address cybersecurity risks, including phishing attacks, ransomware, data breaches, and insider threats. Our vice president of information security has over 15 years of information security experience, including in developing, overseeing and managing information technology and information security teams. He has been with our company since 2017 and has served as our vice president of information security since April 2023. He previously served as our executive director of information security from January 2022 through April 2023, senior director of information security from February 2019 through January 2022 and director of information security from June 2017 through February 2019. Prior to joining our company, our vice president of information security worked at several technology companies and served in roles of increasing responsibility with respect to information security during his tenure.

companyName: Schrodinger, Inc.

ticker: SDGR


text: We also engage consultants or other third parties in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as in monitoring and testing our safeguards.

companyName: AMBARELLA INC

ticker: AMBA


text: Pega Cloud Security Posture Pega Cloud undergoes several security assessments a year. Redacted versions of these reports are made available to our clients. Pega Cloud also maintains several security certifications, which are listed at https://pega.com/trust, which is included as an inactive reference and the content of which is not incorporated by reference into this Annual Report.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: We depend on software applications, information technology systems, computing infrastructure and cloud service providers to operate our business. These systems are managed, hosted, provided or used by third parties, to assist in conducting our business and which have their own cyber security measures in place. We do not separately implement generally applicable industry standards or best practices processes for the assessment, identification, and management of material risks from cybersecurity threats to our information technology systems.

companyName: OZ VISION INC.

ticker: UNXP


text: In the event of a cybersecurity incident, our businesses maintain incident response plans meeting certain enterprise-established standards. Such incident response plans address the roles and responsibilities of personnel across our enterprise, required steps to take in response to an incident, incident communications plans, designated contacts for outlined response activities and playbooks to guide responses to certain common types of threats that we face. These incident response plans are reviewed and updated at least annually, with table-top exercises performed at least annually. We also have established relationships with various third-party experts and advisors to provide support in the event of a cybersecurity incident. In addition, we maintain insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cybersecurity incidents. In conjunction with our incident response plans, we also have a process to assess whether a cybersecurity incident triggers applicable regulatory reporting obligations.

companyName: Post Holdings, Inc.

ticker: POST


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise information technology environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors who have access to our critical systems and information.

companyName: 10x Genomics, Inc.

ticker: TXG


text: Our risk-based processes, as designed, seek to maintain physical, administrative and technical controls that protect the confidentiality, integrity and availability of our information systems and information stored on our network, including customer information, personal information, intellectual property and proprietary information.

companyName: SHOE CARNIVAL INC

ticker: SCVL


text: The Board regularly receives information security and cybersecurity updates, and the Committee receives quarterly reports from management, including the Vice President & Head of Technology and the Director of Cybersecurity and Technology Operations, on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding significant cybersecurity incidents.

companyName: Rexford Industrial Realty, Inc.

ticker: REXR


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems we use, including systems provided by third party service providers, we utilize a regularly updated incident response plan that was developed taking into account a recognized third party cybersecurity framework. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the team is generally led by the CISO or another member of the dedicated cybersecurity team, and will include other information technology and legal personnel. The incident response team regularly reports to senior management, including the CEO, CFO, COO and CLO in the event of a potentially significant cybersecurity incident. The CISO or another member of the incident response team also reports to the Company's Disclosure Committee, which makes determinations regarding SEC reporting obligations related to the cybersecurity incident and consists of senior officers in the operations, finance, and legal functions. The Disclosure Committee also consults with the chair of the Audit Committee of the board of trustees in making determinations regarding applicable SEC reporting requirements.

companyName: American Homes 4 Rent

ticker: AMH


text: At the management level, leading our efforts is a cybersecurity team that reports directly to our Senior Vice President. This team conducts manual and automated testing on our systems, with the goal of identifying vulnerabilities and proactively strengthening our defenses. We believe that embracing a multi-layered defense approach, will help us recognize and address the dynamic nature of cyber threats. By integrating diverse security measures, we aim to fortify our infrastructure against a spectrum of potential risks, adapting to the ever-evolving cybersecurity landscape.

companyName: INTELLIGENT PROTECTION MANAGEMENT CORP.

ticker: IPM


text: Members of our senior management team have specific and relevant cybersecurity expertise and experience, including the following: • Our CISO has more than 30 years of experience in technology and cybersecurity, he also holds multiple professional certifications in security, privacy, governance, audit, and technology. • Our CIO has more than 17 years of experience in technology, she has directly managed global privacy, compliance, ethics, and records retention technology, has been responsible for addressing global cybersecurity risks, and has also attended multiple training programs in cybersecurity, privacy, governance, and technology. • Our VP, Enterprise Risk Management holds a Certificate in Risk and Information Systems Controls certification and has more than 25 years of experience in managing technology delivery, vendor management, privacy, and governance.

companyName: Employers Holdings, Inc.

ticker: EIG


text: Our executive management team is responsible for day-to-day assessment, identification and management of material risks from cybersecurity threats, including the prevention, mitigation, detection, and remediation of cybersecurity incidents. The individuals currently serving in these roles are our Chief Executive Officer and Chief Technology Officer. The executive management team monitors current events in order to remain aware of current cybersecurity threats and is informed of cybersecurity incidents as they arise by our frontline personnel.

companyName: Dror Ortho-Design, Inc.

ticker: DROR


text: Additionally, we employ innovative technology solutions designed to identify, protect, detect, and mitigate cybersecurity threats through use of firewalls, intrusion detection systems, patching, endpoint detection and response, encryption, multi factor authentication, and data backups to immutable storage.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: The cybersecurity risk management program includes an incident response plan with a cross-functional team comprised of designated members of the information technology department, senior management, and other appropriate individuals. The team is responsible for assessing and managing the cybersecurity incident response process, as outlined within the incident response plan, and taking necessary corrective actions to mitigate and eliminate the issue.

companyName: Seneca Foods Corp

ticker: SENEA


text: These frameworks inform the design of our security controls and risk mitigation strategies. While we believe our Information Security Program is well-designed, cyber threats continue to evolve. Consequently, despite our efforts, the Company's cybersecurity strategy may not be sufficient to prevent all incidents. No system is entirely secure, and the Company may not be able to anticipate or prevent every security breach. For additional information on how cybersecurity risk may affect the Company's business strategy, results of operations or financial condition, please refer to Item IA. Risk Factors - Risks Related to Cybersecurity, Data and Fraud.

companyName: First Financial Northwest, Inc.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register; (2) the information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our Technology Steering Committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee of the board of directors, which evaluates our overall enterprise risk.

companyName: MACROGENICS INC

ticker: MGNX


text: Related to Cybersecurity Risks Our board of directors considers cybersecurity risk as part of its risk oversight and has delegated the Audit Committee of the board of directors oversight of cybersecurity risks. The Audit Committee oversees management's implementation of the cybersecurity program. We have also established a process for escalation of major cyber incidents, if applicable, to be reported to the Executive Leadership Team and the Audit Committee. Additionally, we conduct periodic meetings to keep the Executive Leadership Team and Audit Committee apprised of our risk management and overall cyber strategy, as appropriate.

companyName: RAPID MICRO BIOSYSTEMS, INC.

ticker: RPID


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Audit Committee of our Board is responsible for the oversight of cybersecurity-related risks. The Audit Committee regularly receives reports from management on our cybersecurity threat risk management and strategy processes, including on topics such as our data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, incident response plans, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to these risks. The Audit Committee received reports from our Chief Information Officer ("CIO") and/or CISO four times in 2023.

companyName: GE HealthCare Technologies Inc.

ticker: GEHC


text: Infrastructure and Data Protection. We have technical and organizational safeguards that are designed to protect our networks, systems, and data from cybersecurity threats, including: firewalls, intrusion prevention and detection systems, network and endpoint anti-malware protections, and access controls such as privileged access management. Our information security and information technology teams collaborate regularly to assess the security of current and future infrastructure changes.

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, using common methodologies, reporting channels and governance processes that apply to other risks managed by our organization, including operational, financial and strategic risks, as well as applicable legal and regulatory risks. MAMMOTH ENERGY SERVICES, INC.

companyName: MAMMOTH ENERGY SERVICES, INC.

ticker: TUSK


text: The Chief Information Security Officer ("CISO"), under the supervision of the Company's Chief Risk Officer ("CRO") in coordination with the Company's executive team, which includes our CEO, CFO, Chief Technology Officer ("CTO") and Chief Legal Officer ("CLO"), works collaboratively across the Company to implement the Information Security Program, which is designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: Because we are aware of the risks associated with relying on third-party service providers, to, among other things, estimate quantities of oil and natural gas reserves, analyze seismic and drilling information, process and record financial and operating data and communicate with employees and third parties, SandRidge implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes assessments by our internal audit and IT professionals. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: SANDRIDGE ENERGY INC

ticker: SD


text: The CISO, in coordination with the Risk Management Committee, which includes our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Senior Vice President of Policy and Administration, and General Counsel ("GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and reports significant (including potentially material) threats and incidents to executive leadership.

companyName: LKQ CORP

ticker: LKQ


text: Management, in coordination with our information technology department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy by educating, and communicating key priorities such as potential threat awareness, vendor scrutiny and device security to relevant personnel. Management is also responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.

companyName: INDEPENDENCE REALTY TRUST, INC.

ticker: IRT


text: Recognizing employees are heavily targeted for compromise, security prioritizes social engineering and phishing awareness with weekly organization-wide updates, quarterly and annual training. Additionally, we manage client systems with end-point protection tools and monitoring agents to prevent malware and ransomware attacks. Samples are uniquely identified with a code number only, and de-identified to minimize potential exposure during processing. All data is encrypted at rest and in transit with industry standards. Regular network and application penetration testing is performed to identify potential vulnerabilities.

companyName: FOXO TECHNOLOGIES INC.

ticker: FOXO


text: We view cybersecurity as the prevention and timely detection and correction of any unauthorized occurrence or series of related unauthorized occurrences that are on or conducted through our information systems and that jeopardizes the confidentiality, integrity, or availability of our systems or any information residing therein. We believe that the safety, security, and privacy of our customers and employees are fundamental to the services we provide. Our cybersecurity policies guide us as we strive to continuously enhance methods, best practices, and technologies to better monitor and protect customer data and inform and enable customers to make choices about their data privacy. We carefully consider data privacy when developing our own products and when incorporating products provided by our business partners.

companyName: ADT Inc.

ticker: ADT


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our risk management team collaborates with our Chief Information Security Officer ("CISO") to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have processes designed to detect potential vulnerabilities and anomalies through technical safeguards and have adopted policies and procedures around internal and external notification of cybersecurity incidents.

companyName: MACOM Technology Solutions Holdings, Inc.

ticker: MTSI


text: In the event of a cybersecurity incident, we maintain an incident response plan. This plan sets forth immediate actions to mitigate the impact of cybersecurity incidents, including referring certain matters to the our chief executive officer for additional evaluation and oversight, as well as long-term strategies for remediation and prevention of future cybersecurity incidents.

companyName: SOUTH DAKOTA SOYBEAN PROCESSORS LLC

ticker: SDSYA


text: The IS Program is designed to provide safeguards for Key's assets through a series of administrative, technical, and physical controls. Key employs a variety of security practices and controls to protect information and assets, including, but not limited to, access controls, vulnerability scans, network monitoring, internal and external penetration testing, monitoring of vendor vulnerability notices and patch releases, scanning of systems and emails for malware and other vulnerabilities, firewalls and intrusion detection and prevention systems, and dedicated security personnel. As described in more detail in "Risk Management — Overview" in Item 7 of this report and in "Cybersecurity Governance" below, Key employs the "Three Lines of Defense" in its risk governance framework. Assessing, identifying, and managing cybersecurity risk across the organization in support of the IS Program is a cross-functional effort that requires collaboration and direction from all lines of defense – the lines of business and support functions (First Line of Defense), Risk Management (Second Line of Defense), and the Risk Review Group (RRG), Key's internal audit function (Third Line of Defense): • First Line of Defense – Lines of Business and Support Functions. Primary responsibility for day-to-day management of cybersecurity risk lies with the senior management of each of Key's lines of business (LOB) and support functions. The LOB and support functions own and manage the individual processes and procedures that are used throughout the IS Program, implement and manage business-specific security controls, and enforce behavioral controls throughout the management structure. • Second Line of Defense – Risk Management. Risk Management oversees risk and monitors the First Line of Defense controls. Operational Risk Management performs review and challenge of controls, monitors the operational risk profile, and ensures Key operates within its operational risk appetite. Compliance Risk Management provides an independent, enterprise-wide function that focuses on compliance with laws, rules, regulations, and guidance applicable to Key. Privacy Compliance, which sits within Compliance Risk Management, provides advisory support, governance, and oversight of privacy-related statutes, regulations, and risks related to Key's customers, employees, and other individuals from who Key collects personally identifiable information. • Third Line of Defense – Risk Review Group (RRG). The RRG reviews and evaluates the scope and breadth of security activities throughout Key and the effectiveness of the IS Program. RRG conducts independent internal audits on Key's LOBs, operations, information systems, and technologies. These internal audits provide an independent perspective on Key's processes and risks. Technology risks are evaluated in areas including cybersecurity and information security, data control, acquisition and development, delivery and support, business continuity, and information technology governance. RRG shares the results of its audits with the LOB management, Key's Operational and Compliance Risk Management Groups, the Board's Audit Committee, and banking regulators.

companyName: KEYCORP /NEW/

ticker: KEY


text: Although the aggregate impact on our operations and financial condition has not been material to date, the Company has been the target of cybersecurity attacks and anticipates continued attempts as threats become more sophisticated and frequent. Future incidents may have a material effect on our business.

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: Our objectives for managing cybersecurity risk is to greatly minimize the impacts of external threats. This includes, but is not limited to, efforts to penetrate, disrupt or misuse our systems or information. Our information security program is designed to comply with industry standards, such as the National Institute of Technology Cybersecurity Framework. We successfully leverage several associations, industry groups, audits and enhanced monitoring to promote the effectiveness of our program. Our Chief Technology Officer, who reports to our Chief Operating Officer, collaborates regularly with peer banks and other industry groups to identify and implement best practices. Our program is regularly reviewed in an effort to address emerging trends and threats.

companyName: CB Financial Services, Inc.

ticker: CBFV


text: In the event of an incident, we intend to follow our cybersecurity incident response plan, which outlines the steps to be followed from incident detection to mitigation, and notification. We contract with external firms that have extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks. We must comply with extensive regulations, including requirements imposed by the Federal Drug Administration related to adequately safeguarding patient information and reporting cybersecurity incidents to the SEC. We believe we are positioned to meet the requirements of the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach. We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a clinical site, subcontractor, or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the direct impact of the incident.

companyName: Aditxt, Inc.

ticker: ADTX


text: Company is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Company has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence, responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Executive Officer. Working in close coordination with the Board of Directors, the CEO oversees our governance programs, including testing our compliance standards, remediating known risks, and has ongoing direct interaction with our IT department and periodic interaction with external cybersecurity experts, as needed.

companyName: Novo Integrated Sciences, Inc.

ticker: NVOS


text: As an externally managed company, our day-to-day operations are managed by our Manager and our executive officers under the oversight of our board of directors. Our executive officers are senior Blackstone Real Estate professionals and our Manager is a subsidiary of Blackstone. As such, we are reliant on Blackstone for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Blackstone has provided to us regarding its cybersecurity program that are relevant to us.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: As part of our risk management process, we conduct application security assessments, vulnerability management, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. We are implementing a plan to require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs at least annually.

companyName: AMERICAN BATTERY TECHNOLOGY Co

ticker: ABAT


text: The Audit Committee oversees the Company's risk management policies, including the management of risks arising from cybersecurity threats. The Audit Committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including annual assessments of internal and third-party policies, vulnerability assessments, technological trends and information security considerations arising with respect to the Company and our Adviser. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with our Adviser, including the Adviser's Director of Information Technology.

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: b.through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;

companyName: EXAGEN INC.

ticker: XGN


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Audit Committee") oversight of cybersecurity and other IT risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Evolv Technologies Holdings, Inc.

ticker: EVLV


text: Dominion Energy utilizes an organization structure known as a converged security model that brings together cybersecurity, physical security and threat intelligence within one department led by the chief security officer. The chief security officer joined Dominion Energy in this role in 2018 and has an extensive background in security having retired from the Federal Bureau of Investigation after a more than 20-year career focused on criminal, counter-terrorism, counter-intelligence and cyber investigations. The chief security officer belongs to the Federal Bureau of Investigation's Domestic Security Alliance Council, the Department of Homeland Security's Classified Intelligence Forum and is a member of the national Government/Business Executive Forum. In addition to serving on multiple university advisory boards, the chief security officer also serves on the Commonwealth of Virginia's Informational Technology Advisory Council.

companyName: DOMINION ENERGY SOUTH CAROLINA, INC.


text: The integrity and protection of our customer, personnel, financial, research and development, and other confidential data is critical to our business, and our customers and employees have a high expectation that we will adequately protect their personal information. The regulatory environment governing information, security and privacy laws is increasingly demanding and continues to evolve and a number of states have adopted laws and regulations that may affect our privacy and data security practices regarding the use, disclosure and protection of PII. For example, the California Consumer Privacy Act ("the CCPA"), among other things, creates individual privacy rights and imposes increased obligations on companies handling PII.

companyName: Beyond Air, Inc.

ticker: XAIR


text: The Company's CTO reports to our Chief Executive Officer and has been with Euronet 16 years and is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board of Directors (the "Board"). Many on our Information Technology ("IT") security team leadership have over a decade of cybersecurity and IT control experience, certifications, and external and internal IT audit experience. The Chief Information Security Officer ("CISO") reports to executive management independent of IT and is responsible for management of cybersecurity risk, security governance and compliance, security policies, security training, and the overall protection and defense of our networks, systems, and company data. The CISO manages the global security governance, risk, and compliance teams and is responsible for ensuring we meet our regulatory and compliance requirements as related to PCI DSS, ISO 27001, and other certifications we hold globally that support our business products and services. The Global Director of Cybersecurity reports to the CTO and manages our security toolbelt and implementations, incident response, alert management, and various technical security teams. The CISO and Global Director of Cybersecurity manage teams of cybersecurity professionals with broad experience and expertise, including PCI and other regulatory compliance, threat assessments and detection, forensic investigations, mitigation technologies, cybersecurity training, incident response, insider threats, third party risk, penetration testing, and security engineering expertise. Many members of the security leadership team across the organization have been with Euronet for more than 10 years. The global and segment security leadership teams work closely with legal, privacy, audit, and compliance teams to ensure we meet regulatory requirements and work together to address cyber risks in all functional areas of the organization. We also conduct strategic in person and virtual annual, quarterly, and monthly security meetings with key members of security and IT leadership to align on security priorities, initiatives, and requirements.

companyName: EURONET WORLDWIDE, INC.

ticker: EEFT


text: We have established certain processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology functions and are designed to help protect our information, assets and operations from internal and external cyber threats. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants, independent privacy assessors, computer security firms and risk management and governance experts, as appropriate to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: Editas Medicine, Inc.

ticker: EDIT


text: We have a team of information security professionals who lead our enterprise-wide cybersecurity strategy, risk management, cyber defense, software security, security monitoring and other related functions. This team is overseen by our Chief Information Security Officer ("CISO"), who reports to our Chief Information Officer ("CIO") and works with our Chief Legal Officer. Our CISO has over 30 years of experience in the fields of cybersecurity and intelligence with the Department of Defense, the defense contracting community and with publicly traded companies, and holds various technical credentials in the field, including a CIO Program Certificate from the College of Information and Cyberspace, National Defense University, and maintains a Certified Information System Security Professional ("CISSP") designation as well as a Certified Information Privacy Professional ("CIPP") designation.

companyName: TD SYNNEX CORP

ticker: SNX


text: The Audit Committee is primarily responsible for overseeing our enterprise risk management process on behalf of the Board of Directors, including cybersecurity risks. The CTO and CISO regularly provide reporting on cybersecurity matters to both senior management and the Audit Committee and at least annually to the Board of Directors. This reporting includes updates on our information security strategy, key cyber risks and threats and our progress towards protecting the Company from such risks and threats, assessments of our cybersecurity program and emerging trends. Depending on the criticality of a cybersecurity incident, certain matters are required to be reported promptly to the Board of Directors, as appropriate, in accordance with our incident response plan.

companyName: CDW Corp

ticker: CDW


text: Incident Management We make continuous efforts to maintain the ability to respond quickly and effectively to security incidents to minimize their impact. We implement an incident response policy, incident response plan, and deploy comprehensive continuous security monitoring solutions to monitor events occurring across its assets. Additionally, a material risk determination model enables our cyber incident response team and senior leadership to determine materiality.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: The Company approaches cybersecurity as an enterprise-wide risk and uses external resources to assess risk and manage its IT and 24x7 cybersecurity operations, including managed service providers who assist in the support of key business systems. The Company may also periodically engage external consultants to assist with cybersecurity incident management, particularly where advanced or specialized expertise may be required. If a material cybersecurity breach occurs, the incident will be reviewed by management to determine whether further escalation is appropriate. The Executive Chairman of the Board and Chief Executive Officer and the Interim Chief Financial Officer have primary responsibility for this review and assessment. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive team, and if deemed necessary or appropriate, the Board of Directors. The Board Audit Committee is responsible for reviewing and discussing the adequacy and effectiveness of the Company's information security policies and the procedures and controls regarding information systems. In addition, we plan to consult with outside counsel as appropriate, including on materiality analyses and disclosure matters, and to assist in making the final materiality determination regarding disclosure and other compliance decisions. We also plan to keep our independent public accounting firm informed of such incidents as appropriate.

companyName: Catheter Precision, Inc.

ticker: VTAK


text: The IT team identifies and assesses cybersecurity threats and risks by monitoring and evaluating the Company's threat environment and risk profile using various methods including, for example: analyzing reports of threats, evaluating threats reported to us, coordinating with law enforcement concerning threats, internal and external security audits, vulnerability scanning, manual and automated detection tools, and continuous network monitoring. We have implemented a range of technical, physical, and organizational controls designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, such as incident detection and response policies, vulnerability management policies, disaster recovery plans, antivirus programs, authentication protocols, encryption of certain data, data segregation, asset management, tracking, and disposal, network security measures, access controls, and change management processes. We also maintain an insurance policy covering network security liability, incident response, business interruption, cyber extortion, social engineering, and computer fraud.

companyName: Avid Bioservices, Inc.


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data depending on the environment. This includes maintaining an incident response plan, vulnerability management policy, and disaster recovery and business continuity plans, conducting risk assessments for certain environments, implementing certain security standards and certifications for certain products and systems, encrypting certain data in transit and at rest, controlling data access in certain environments, using multiple security controls in certain environments, segregating certain data, monitoring certain systems, performing regular security assessments for certain systems, training employees, maintaining cybersecurity insurance, maintaining dedicated cybersecurity staff, and conducting internal and external penetration tests.

companyName: Tenable Holdings, Inc.

ticker: TENB


text: The Risk Committee of our Bank's Board of Directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Information Security Officer and our Chief Information Officer provide quarterly reports to the Risk Committee of our Bank's Board of Directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Risk Committee of our Bank's Board of Directors reviews and approves our information security policies and strategies. The Risk Committee of our Bank's Board of Directors provides a report of their activities to the full Board of Directors at each board meeting.

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: However, we do depend on the digital technologies of third parties, including information systems, infrastructure and cloud applications and services, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents.

companyName: Keen Vision Acquisition Corp.

ticker: KVAC


text: Management along with the support of a third-party IT firm are responsible for the day-to-day administration of our risk management program and our cybersecurity policies, processes, and practices.

companyName: Eiger BioPharmaceuticals, Inc.


text: Our cybersecurity risk management program to protect these assets and systems includes: skilled third-party information security and data privacy personnel, who support our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents;

companyName: VYCOR MEDICAL INC

ticker: VYCO


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cyber security threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function through the Nominating and Corporate Governance ("NCG") Committee.

companyName: COHERENT CORP.

ticker: COHR


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in " Item 1A. Risk Factors " of this Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in " Item 1A. Risk Factors " of this Form 10-K.

companyName: Graf Global Corp.

ticker: GRAF


text: Our risk management program is designed to identify, assess and mitigate risks across our company. When considering financial, operational, regulatory, reputational and legal risk, our program is well matched for our size and complexity. Our Chief Technology Officer, in conjunction with the Chief Operating Officer, is currently responsible for managing our information security program. Given the increasing risk involving cybersecurity and the Bank's evolving needs and reliance on technology, our strategy involves the addition of a Chief Information Security Officer. The Chief Information Security Officer will be primarily responsible for the cybersecurity component of our risk program. These responsibilities include performing and maintaining a cyber risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, access levels, third party risk and vendor management and business continuity planning. This key role will be developed as we expand our overall risk management program.

companyName: CB Financial Services, Inc.

ticker: CBFV


text: We completed our forensic investigation on December 13, 2023. We determined that an unauthorized third-party accessed certain of our systems, deployed a type of malware that is not self-propagating, and exfiltrated certain data. We have no evidence that any customer-owned system was directly impacted in the incident, and no customer has reported that this has occurred. The last confirmed date of unauthorized third-party activity in our network occurred on November 20, 2023.

companyName: Fidelity National Financial, Inc.

ticker: FNF


text: The Company actively monitors alerts and shared intelligence from a variety of industry-standard sources and takes appropriate actions when warranted. As new threats and vulnerabilities emerge that threaten its systems and data, the Company continues to evaluate and address these threats through a layered security approach.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: As of the date of this Annual Report, we do not believe that any past cybersecurity incidents that have been detected have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. We do not carry a separate cybersecurity commercial insurance policy covering the potential financial losses that may occur in the event we experience a cybersecurity incident.

companyName: FILANA THERAPEUTICS, INC.

ticker: FLNA


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO and the Investment Adviser's Committee, are responsible for assessing and managing material risks from cybersecurity threats that impact the Company. The CCO of the Company oversees the Company's oversight function generally and relies on the Investment Adviser's Committee to assist with assessing and managing material risks from cybersecurity threats. The Committee is chaired by an outside cybersecurity and information technology expert, and its other members are the Investment Adviser's Chief Financial Officer, CCO, General Counsel, Chief Operating Officer, and Director of Information Technology. The CCO has been responsible for oversight of the Company's overall SEC compliance program, since the Company's inception and has worked in the financial services industry for more than 25 years, during which time the CCO has gained expertise in assessing and overseeing controls regarding risks applicable to the Company.

companyName: Commonwealth Credit Partners BDC I, Inc.


text: Implementing heightened safety measures, physical-security controls, and controlled-access requirements to protect the Service Center that houses the hardware and infrastructure used to store and transmit sensitive and confidential bank, customer, and employee information in accordance with the FFIEC IT Examination Handbook on Information Security and designating a specialized Service Center Board within the Service Center Department to oversee the protection of the Service Center's physical integrity;

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Cyber Security Plan We have implemented various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature (including without limitation tenant and property related data) ("Information Systems and Data").

companyName: NETSTREIT Corp.

ticker: NTST