text: The AGM board of directors' oversight of cybersecurity risk management is supported by the audit committee of the AGM board of directors (the "AGM audit committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. The AGM board of directors, the AGM audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from Apollo's risk management professionals, AGM's Chief Security Officer ("CSO"), its CISO, and other members of Apollo's management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from Apollo's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM's board of directors and/or the AGM audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM board of directors or the AGM audit committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from AHL's CISO, at least annually.

companyName: Apollo Realty Income Solutions, Inc.


text: The Board of Directors, through the efforts of its Risk Committee, oversees our continuing efforts to strengthen our information security infrastructure and staffing, adhere to regulatory guidelines and enhance our processes, technology controls and cybersecurity defenses. As part of its oversight of operational risk, the Risk Committee is responsible for the oversight of information security and cybersecurity risk management. Our Chief Information Security Officer regularly reports to the Risk Committee on security events, testing, training, audits, new system assessments and the identification and remediation of cybersecurity risks. These reports also include topics such as the threat environment and vulnerability assessments, results of penetration testing, results of key cyber risk indicators and performance metrics, and our efforts to detect, prevent and respond to internal and external critical threats. The Risk Committee receives periodic updates on information security risk, the maturity of our information security program, and related investments and results. On an annual basis, the Risk Committee reviews and approves our information security program and information security policy.

companyName: SANDY SPRING BANCORP INC

secItem: Item 1C


text: In addition, our cybersecurity risk management and data strategy processes are further overseen by management team members. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. Such individuals have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: We have invested in tools and technologies intended to protect our data and business systems, and we monitor our computing environment on an ongoing basis to help identify and assess risk. In addition, we have implemented a cybersecurity training program designed to educate and train employees how to identify, potentially avoid and report cybersecurity threats. It is focused on helping our workforce recognize, avoid falling victim to and raise the visibility of potential cyber threats and scams. In addition, periodic cybersecurity awareness messages are posted to employees on the Company portal as new threats and scams develop throughout the year.

companyName: LiveWire Group, Inc.

ticker: LVWR


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Technology Officer, our Vice President of Engineering Security and our Director of Engineering Security. Each of these individuals has extensive industry experience developed through a significant career in engineering, IT and systems management, and security, respectively. Our Chief Technology Officer received a B.A. in Computing and Artificial Intelligence, and his experience includes the development of intrusion detection and firewall functionality for products at a global technology company. Our Vice President of Engineering Security received an M.S. in Business Analytics, with a focus on Computer and Information Systems, and her experience includes more than 15 years in systems management and administration at a major U.S. financial institution. Our Director of Engineering Security received an M.S. in Telecommunications Networks with a specialization in Security, is a Certified Information Systems Security Professional, and has more than 15 years of experience building security programs, including building and leading the incident response team at a global software company.

companyName: YELP INC

ticker: YELP


text: Risk Management Strategy While no organization can eliminate cybersecurity risk entirely, we devote significant resources to our cybersecurity strategy that we believe is reasonably designed to mitigate our cybersecurity and information technology risk. These efforts are designed to protect against, and mitigate the effects of, among other things, cybersecurity incidents where unauthorized parties attempt to access confidential, sensitive, or personal information; potentially hold such information for ransom; destroy data; disrupt or delay our operations or systems; or otherwise cause harm to the Company, our customers, employees, vendors, or other key stakeholders.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors, including: "We and the third parties with whom we work are subject to stringent and evolving U.S. and foreign laws, regulations and rules, contractual obligations, industry standards, policies and other obligations related to data privacy and security. Our (or the third parties with whom we work) actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse business consequences."; and "If our information technology systems or data, or those of third parties with whom we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, interruptions to operations or clinical trials, reputational harm, litigation, fines and penalties, disruptions of our business operations, and a loss of customers or sales."

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: Our cybersecurity risk management activities and outcomes are guided by the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and assessed by a third party. We follow the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We engage in the following key elements to assess, prioritize and manage risk and compliance: Assessments to help identify material cybersecurity risks to our critical systems, information, services and broader enterprise IT environments;

companyName: Trump Media & Technology Group Corp.

ticker: DJT


text: Cyber threats are considered one of the most significant risks facing financial institutions. Because the Trust has no directors, principal officers or employees, the Sponsor is responsible for managing cybersecurity risks to the Trust. To mitigate risk from cyber threats, Invesco Ltd. ("Invesco"), the Sponsor's parent company, has a designated Global Chief Security Officer ("GCSO") who leads the global security department that is responsible for identifying, assessing, and managing cybersecurity threats across the Invesco organization. The GCSO experience in the public and private sectors, specializing in security, investigations, and incident response. The Global Security Department oversees, among others, the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, and Corporate Security. This converged security structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees, and critical assets safe, upholding privacy rights, while enabling a secure and resilient business.

companyName: Invesco Galaxy Ethereum ETF

ticker: QETH


text: Cyber Risk Management Strategy We have a cyber risk management policy and asset-based cyber risk management methodology for the continuous identification, assessment, and management of our cyber risk exposure. Our cyber risk managers have been trained in our cyber risk management policy and methodology. The methodology is as follows: Maintaining an up-to-date and accurate inventory of all assets (e.g., data, systems, hardware, software, and vendors).

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: Depending on the services performed, we require certain vendor agreements to contain security and privacy addenda and require vendors to report to us cybersecurity breaches on their systems and/or impacts to our data.

companyName: WERNER ENTERPRISES INC

ticker: WERN


text: We, Kronos and CompX face a number of cybersecurity risks. To date, such risks have not materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any major breaches, we actively monitor and mitigate cyber threats, including phishing attempts, malware and targeted attacks. Thus far all such incidents have been minor, isolated and promptly contained. For more information about the cybersecurity risks we face, see the risk factor entitled "Technology failures or cybersecurity breaches could have a material adverse effect on our operations." in Item 1A- "Risk Factors."

companyName: VALHI INC /DE/

ticker: VHI


text: Third-Party Engagement The Company engages a range of third-party advisory service providers, including cybersecurity assessors, consultants, and auditors, to conduct recurrent evaluations of its cybersecurity controls. These reviews are a critical component of the ongoing risk assessment process within the cybersecurity function and include periodic evaluations of internal controls aimed at mitigating cybersecurity threats. These assessments often include penetration tests, evaluations of the Company's cyber program maturity, and assessments of progress toward future-state cyber initiatives, among other considerations. The results of these reviews are reviewed with management and the Company's Board of Directors (the "Board").

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: Oversight of cybersecurity risk involves a three-tiered hierarchy designed to leverage the appropriate level of expertise to assess and manage such risks. This consists of our CISO, SGC and the Audit Committee. Our CISO is primarily responsible for our global information security program. In this role, the CISO is responsible for the effective operation of our information security controls and management of information security and cybersecurity risks across the enterprise, including within our products and operations. The CISO also aligns our information security strategy with our business and technical strategies and integrates, where possible, security initiatives into roadmaps of other functions to promote accountability and awareness. The CISO is also responsible for developing and implementing our information security policies and standards in accordance with applicable global regulatory requirements and facilitating updates to these policies and standards at least annually. Our CISO has over 20 years of global information security leadership experience across financial services, legal and medical device industries and over 35 years of broader IT experience.

companyName: QuidelOrtho Corp

ticker: QDEL


text: The Board oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. Pursuant to the Audit Committee Charter, the Audit Committee of the Board provides compliance oversight to the Company's risk assessment and risk management policies, including for cybersecurity, and the steps management has taken to monitor and mitigate cybersecurity exposures and risks.

companyName: Dave Inc./DE

ticker: DAVE


text: The Company maintains cyber liability insurance to help mitigate potential liabilities resulting from cybersecurity matters. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. We do not believe that any risks we have identified to date, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, despite our security measures, there is no assurance that we or the third parties with which we interact, have not identified or experienced, or will not experience a cybersecurity incident in the future that will materially affect us. For additional information regarding the risks to us associated with cybersecurity incidents, see "A data breach or cybersecurity incident could result in a loss of confidential data, give rise to remediation and other expenses, expose us to liability under federal and state data protection and data privacy requirements, foreign data privacy regulations, consumer protection laws, common law theories, and other laws, rules and regulations, subject us to litigation and governmental inquiries and actions, damage our reputation, and otherwise adversely impact our financial results and business" included in Part I, Item 1A of this Form 10-K.

companyName: HEALTHSTREAM INC

ticker: HSTM


text: As part of the above processes, we regularly engage external auditors and consultants with expertise in cybersecurity to assess our internal cybersecurity programs and compliance with applicable practices and standards.

companyName: TEJON RANCH CO

ticker: TRC


text: Employees play a significant role in the defense against cybersecurity threats. Every employee is responsible for protecting the Company and client information. Accordingly, employees complete formal training and acknowledge security policies annually. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities.

companyName: Esquire Financial Holdings, Inc.

ticker: ESQ


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with, or effective in protecting our systems and information. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Traeger, Inc.

ticker: COOK


text: Malware infection: There is a risk of losing sales due to information leaks or system downtime caused by unauthorized access due to malware infection. We are protecting against this by introducing email training and detection products.

companyName: SBC Medical Group Holdings Inc

ticker: SBC


text: Management and Strategy our business information, intellectual property, customer and employee data and technology systems is essential for the continuity of our business, meeting applicable regulatory requirements and maintaining the trust of our stockholders. Cybersecurity is an important and integrated part of our enterprise risk management function that identifies, monitors and mitigates business, operational and legal help protect us from a major cybersecurity incident that could have a material impact on operations or our financial results, we have implemented policies, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps we take to reduce our vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include, but are not limited to: annual penetration testing by a third party vendor, cloud and agent based security scanning that runs continuously, establishing information security policies and standards, implementing information protection processes and technologies, monitoring our information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third-parties, and implementing cybersecurity training. In addition, we annually purchase a cybersecurity risk insurance policy that would help defray the costs associated with a covered cybersecurity incident if it occurred.

companyName: ACORN ENERGY, INC.

ticker: ACFN


text: Cybersecurity threats are assessed, identified, and managed within our Enterprise Risk Management Framework. We use a multi-layered approach to effectively manage risk. This approach includes, but is not limited to: (1) employees who are responsible for and manage risk; (2) employees and systems that oversee, monitor, and report risk: and (3) independent assurance, evaluation, and oversight of risk management activities.

companyName: ISABELLA BANK CORP

ticker: ISBA


text: Our Board is engaged in the oversight of cybersecurity threat risk management. As reflected in the Audit Committee's charter, the Board has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee, which provides advice and guidance on the adequacy of the Company's initiatives on, among other things, cybersecurity risk management. The Chief Information Officer presents regular updates to the Audit Committee and the full Board of Directors, on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, and the emerging threat landscape. The Company also engages third parties to periodically evaluate and audit aspects of the Company's information security programs, including by conducting vulnerability assessments and penetration testing, and the results of those findings are reported to the Audit Committee and used to help identify potentially material risks and prioritize certain security initiatives.

companyName: BlueLinx Holdings Inc.

ticker: BXC


text: To support management's role in assessing and managing cybersecurity threats, our cybersecurity team conducts periodic security review meetings designed to identify vulnerabilities and review remediation efforts. In addition, we maintain a comprehensive Security Response Policy, which sets forth various actions to be taken in the event of a suspected security breach, including incident verification by our cybersecurity team, notification of our cybersecurity committee, and mitigation and remediation actions. We also have a range of controls designed to identify, assess, mitigate, manage, and thereby seek to minimize the cybersecurity risks associated with the engagement of third-party service providers.

companyName: Hamilton Lane INC

ticker: HLNE


text: Blackstone has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors, including those of companies externally managed by Blackstone. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of Blackstone data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Blackstone may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing its requirements and industry best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Blackstone also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data. For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Blackstone in managing these risks, see "Part 1. Item 1A. Risk Factors – Risks Related to Our Company – Cybersecurity risks and data protection could result in the loss of data, interruptions in our business, damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations " in this Annual Report on Form 10-K.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: Development and Periodic Testing of Incident Response and Recovery Planning: We have developed and maintain comprehensive incident response and recovery plans that address our response to a cybersecurity threat, and such plans are tested and evaluated on a regular basis. Our periodic testing of these plans include a wide range of activities, such as audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, internal audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: POTBELLY CORP

ticker: PBPB


text: The incident response, investigation, and notification phase of our IRP addresses the distinct but simultaneous workstreams that occur internally once an event has been determined to be a security incident. This includes technical response such as technical evidence collection and preservation, thread containment and eradication, and system and data restoration. Additionally, incident investigation efforts begin to determine the scope and severity of the security incident with legal and finance stakeholders. If appropriate, further measures are taken to comply with disclosure obligations as required by governance guidelines, committee charters, and applicable laws and contracts.

companyName: ContextLogic Inc.


text: We use third-party service providers to perform various functions throughout our business, such as application providers and hosting companies. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, legal counsel, cybersecurity consultants, cybersecurity software providers, penetration testing firms, and forensic investigators.

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: In 2024, a Security Posture Assessment was conducted by a leading global cybersecurity firm. To perform its assessment, the consultants met with members of our key staff and requested to review documents including, but not limited to, our policies, procedures, past security assessments and penetration tests, documentation regarding network architecture, and security road maps and plans. When such risk assessments are performed, we work with our CISO-level advisor to review any findings from the risk assessment and to identify potential deficiencies in each category and work to close the identified gaps. With our CISO-level advisor's assistance, we have implemented several industry leading solutions, policies, and practices to close those findings and matured Century's defense and resiliency postures. We also have developed an Information Security Incident Response Policy which has been reviewed by our CISO-level advisor. Additionally, we retain a variety of cybersecurity consulting firms, including our CISO-level advisor, to assist us in conducting tabletop exercises to evaluate our incident response plan and response capabilities, most recently in December 2024.

companyName: Century Communities, Inc.

ticker: CCS


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical infrastructure, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our employees and customers ("Information Systems and Data").

companyName: Sprout Social, Inc.

ticker: SPT


text: The Cooper Standard IT leadership team manages the global cybersecurity and IT compliance organization, and the Senior Vice President, Chief Information Technology Officer directly reports updates to the Audit Committee of the Board of Directors at least twice annually and the full Board of Directors at least annually. Further, our cybersecurity team periodically reports to our Global Leadership Team ("GLT"). Data privacy, cybersecurity and digitization is also managed as a material topic as a part of our Enterprise Risk Management ("ERM") Committee which ensures cybersecurity risks are integrated into our overall risk management. From an accountability perspective, our internal audit team independently assesses the cybersecurity program by evaluating the design and effectiveness of our controls. We have an Architecture Review Board ("ARB") which reviews new IT initiatives to ensure they align with our digital strategy. Similarly, our Project Management Office ("PMO") monitors those initiatives throughout implementation to ensure proper communication and seamless transition. The ARB and PMO processes include cybersecurity requirements designed to ensure this topic is considered from the beginning.

companyName: Cooper-Standard Holdings Inc.

ticker: CPS


text: Our board of directors has ultimate risk oversight responsibility for the Company and administers this responsibility both directly and with assistance from its committees. The Audit Committee oversees our overall enterprise risk management program and assists the entire board in fulfilling its oversight responsibility with respect to our information security and technology risks. The Audit Committee actively reviews and discusses our information security and technology risk management programs and regularly reports to the entire board on our relevant strengths and opportunities.

companyName: RCI HOSPITALITY HOLDINGS, INC.

ticker: RICK


text: The Company's cybersecurity program is focused on continuous improvement and takes a layered approach to cybersecurity to include prevention, detection, and response-based controls. Our preventative measures include network-based controls, malware defenses, email security, encryption for data in motion and at rest, continuous vulnerability testing and mitigation, and multi-factor authentication. Our detection and response measures include comprehensive logging and continuous monitoring utilizing both in-house and Managed Security Services, forensics capability, and an enterprise crisis management function.

companyName: Alight, Inc. / Delaware

ticker: ALIT


text: Oversight responsibility in this area is shared by management, the Board, and its Corporate Governance Committee. To prevent, detect and respond to information security threats more effectively, the Company has established a Management Cybersecurity Committee (MCC) consisting of the Chief Financial Officer, the Executive Vice President, General Counsel and Secretary, the Chief Marketing Officer, business unit leaders, the third-party IT consultant, and other internal and external IT resources. The MCC regularly reports to the Corporate Governance Committee, which in turn reports to the Audit Committee and the Board. The Board also receives an annual update from our senior leadership on cybersecurity and information security matters. The Corporate Governance Committee regularly briefs the Board on these matters, and the Board also receives periodic briefings on cyber threats to enhance our directors' awareness on cybersecurity and information security issues.

companyName: Heritage Global Inc.

ticker: HGBL


text: Our enterprise risk management team consists of cross-functional professionals who collaborate with subject matter specialists, as necessary, including an independent third-party expert we have retained to identify and assess material risks from cybersecurity threats, their severity, and potential mitigation steps. Our Chief Financial Officer, Kathleen Borthwick, currently serves as our Chief Cybersecurity Officer and leads our cybersecurity risk assessment and management processes. Prior to being named CFO, Ms. Borthwick served as the Company's Senior Vice President, Finance, and interim CFO. She is supported by external Information Technology and third-party internal audit personnel who regularly review and assess cybersecurity initiatives, including our incident response plan, as well as cybersecurity compliance, training, and risk management efforts.

companyName: Passage BIO, Inc.

ticker: PASG


text: While our Board of Directors has responsibility for the oversight of risk management on an enterprise-wide basis, it has delegated certain risk oversight responsibilities to its committees. The Audit & Finance Committee of our Board of Directors is tasked with, among other things, providing oversight of cybersecurity risk.

companyName: BERRY GLOBAL GROUP, INC.


text: We have a team of skilled internal and external cybersecurity professionals, led by our Vice President of Information Technology, Chief Information Officer and Chief Information Security Officer ("CIO"), who has over three decades of experience in information security and information technology infrastructure. Our team has experience in information security and information technology infrastructure and holds several advanced and expert licenses and certifications, including International Society of Automation 62443, Cybersecurity Expert and International Information System Security Certification Consortium (ISC2), Certified Information Security Manager (CISM), and Certified Information Systems Security Professional (CISSP). Beginning in 2025, the Sustainability & Safety Committee of our Board of Directors ("the Board") has oversight of our cybersecurity and risk management programs. Prior to that, the full Board exercised oversight of cybersecurity risk management. The Board moved oversight of cybersecurity risk management into the Sustainability & Safety Committee to allow for more in-depth reviews. The Sustainability & Safety Committee receives at least quarterly updates from the CIO on cybersecurity matters and our related risk management program, and periodic updates from external cybersecurity experts on the overall risk landscape. Our full Board of Directors also receives an update at least once a year on these matters in addition to regular reporting from the Sustainability & Safety Committee on matters reviewed. We have implemented processes for continual monitoring of our information systems, including the deployment of advanced security measures and system audits to identify potential vulnerabilities. If a cybersecurity incident were to occur, we have developed and documented an incident response plan that includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. Additionally, our CIO regularly meets with our executive management leadership team to provide updates on our cybersecurity risks and incidents ensuring management is keenly aware of any potential threat.

companyName: Ingevity Corp

ticker: NGVT


text: Our Board of Directors is ultimately responsible for cybersecurity risk and has delegated its oversight to the Audit Committee. The Audit Committee considers cybersecurity risks in connection with its financial and compliance risk oversight role. The Audit Committee receives updates on cybersecurity risks and key initiatives for mitigating those risks from the CISO and CFO. For more information about the potential impact of cybersecurity risks, please refer to Item 1A. Risk Factors.

companyName: Loar Holdings Inc.

ticker: LOAR


text: Following the conclusion of an incident the incident response team will generally assess the effectiveness of the cybersecurity program and make adjustments as appropriate.

companyName: LXP Industrial Trust

ticker: LXP


text: The Director of Information Security and Compliance assesses our cybersecurity readiness through internal assessment tools as well as third-party control testing, vulnerability assessments and evaluation against industry standards. We maintain compliance structures that are designed to elevate issues relating to cybersecurity to our Director of Information Security and Compliance and to our Executive Vice President and Chief Information Officer.

companyName: SAIA INC

ticker: SAIA


text: Our Steering Committee was established to further strengthen our cybersecurity risk management activities across the Company, including the prevention, detection, mitigation and remediation of cybersecurity incidents. The Steering Committee has primary management oversight responsibility for assessing and managing risks from cybersecurity threats and is responsible for developing and coordinating enterprise cybersecurity policies and strategies and for providing guidance to key management and oversight bodies. Our Vice President of Information Technology, who has nearly two decades of information technology and cybersecurity risk management experience in the oil and natural gas industry, serves as the chair of the Steering Committee. The Steering Committee includes senior executives and managers, with significant risk management expertise, from multiple areas of the business. The Steering Committee meets quarterly and reports to senior management regarding the progress of specific cybersecurity objectives. Cross-enterprise action teams will be formed, as needed, to manage and implement key decisions of the Steering Committee. A strong partnership exists between our information technology, finance, operations, internal audit, and legal departments for the purpose of addressing identified issues in a timely manner and reporting incidents as required.

companyName: Amplify Energy Corp.

ticker: AMPY


text: We believe our Chief Digital and Technology Officer and our Chief Security Officer have the appropriate knowledge and expertise to effectively manage our cybersecurity program. The Chief Digital and Technology Officer has experience leading enterprise digital transformation efforts for a large multinational corporation and held several leadership and growth positions at a global technology consulting and services firm before joining UnitedHealth Group. Our Chief Security Officer has more than 30 years of experience as a security professional in both the private and public sectors, including in law enforcement. Prior to joining UnitedHealth Group, he served in security leadership roles at several large multinational corporations and has additionally served on cybersecurity advisory boards for some of the largest corporations in the country.

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: We have not identified risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Refer to "Item 1A. Risk Factors", including "Cybersecurity incidents, including cyber-attacks, unauthorized access to, or accidental disclosure of, personal information including payment card information, that we or our vendors collects or stores on our behalf may result in significant expense and negatively impact our reputation and business," for additional discussion about our cybersecurity risks.

companyName: Callaway Golf Co

ticker: CALY


text: A system designed to protect and monitor data and cybersecurity risk has been implemented. Regular assessments of our cybersecurity safeguards and those of certain of our third-party service providers are conducted by independent firms. Our internal management team conducts regular evaluations designed to assess, identify and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies, and education programs in response.

companyName: Prairie Operating Co.

ticker: PROP


text: We recognize that cybercriminals frequently target employees to gain unauthorized access to information systems. Therefore, from onboarding and at least annually thereafter, the Company educates and trains its employees on cybersecurity leading practices using a variety of methods, which is supplemented throughout the year with regular phishing and other cyber-related testing. The Company regularly performs internal and external penetration testing and vulnerability scanning with the support of well-established third-party providers. Identified deficiencies or vulnerabilities are reviewed by the IT staff and management, and remediation steps are taken based on the criticality of the results.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: Our board of directors, as a whole, has responsibility for risk oversight, although the committees of our board of directors oversee and review risk areas that are particularly relevant to their respective functions. Among its focus areas, our audit committee reviews matters relating to cybersecurity and data privacy and regularly reports to our board of directors regarding such matters. One member of our audit committee earned the NACD's CERT Certificate in Cybersecurity Oversight in 2023. Our audit committee receives quarterly cybersecurity-related updates from our Chief Information Security Officer, who we refer to as our CISO, including in the form of written reports and presentations. Our CISO and audit committee also provide cybersecurity-related updates to the full board of directors three times per year, including regarding recent developments, evolving standards, metrics about cyber threat response preparedness, program maturity milestones, material cybersecurity risks and risk mitigation status, and the current and emerging threat landscape. We also have implemented controls and procedures that provide for the communication of material cybersecurity incidents to our Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer, as well as to our audit committee and/or to our full board of directors on a timely basis.

companyName: UPWORK, INC

ticker: UPWK


text: Lightbridge utilizes third-party vendors to manage its Information Technology (IT) systems and has a Managed Service Provider (MSP) for general administration of the IT process including providing a Chief Information Security Officer (CISO), who is responsible for leading our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The MSP utilizes a Security Information and Event Management (SIEM) system to monitor the IT Infrastructure. This and other third-party security applications provide reports that include but are not limited to Endpoint protection, Employee Security scores, Phishing reports, Dark Web scanning and Vulnerability scanning. The CISO reports to our CFO. This CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the industry, many of whom hold cybersecurity certifications, and through the use of technological tools and software and results from third-party audits. The CISO issues quarterly reports and reports to the CFO, as appropriate, providing updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. The Company requires its employees to take a yearly cyber training course and its employees are also required to sign confidentiality agreements for purposes including ensuring cybersecurity.

companyName: LIGHTBRIDGE Corp

ticker: LTBR


text: Our cybersecurity risk management processes include a suite of IT and security policies and procedures, tabletop simulation exercises, technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. We also leverage government partnerships, industry and government associations, third-party benchmarking, internal and third-party audit results, threat intelligence feeds and other similar resources to inform our cybersecurity processes. Our technical controls are regularly evaluated and assessed, including through internal audits, by an annual third-party assessment of our cybersecurity posture and a biannual assessment of our cybersecurity standards, processes and team. Our Information Technology Steering Committee approves the implementation of new technologies and upgrades of our current systems using a formal process that includes a rigorous third-party risk assessment. This assessment evaluates and mitigates cyber risk associated with any new technology or suppliers before they are deployed. We employ continuous monitoring technology that provides real-time updates on our suppliers' cyber security posture, alerting us to any significant changes due to cyber events or technological shifts. In our contractual process with third party providers, we require initial and ongoing certification of their cyber security and data protection standards.

companyName: MARATHON OIL CORP


text: Although none of the members of the Audit Committee have any work experience, degree, or certifications related to information security or cybersecurity, the Audit Committee is often guided by IT professionals on cybersecurity related issues. Periodically, the Audit Committee receives an overview from IT professionals on our cybersecurity threat risk management and strategy processes, including potential impact on our company, the efforts of management to manage the risks that are identified, and our disaster recovery preparations. IT professionals provide updates to inform and educate our Audit Committee and Board of Directors on current trends of cybersecurity threats, emerging trends, and best practices.

companyName: Harbor Custom Development, Inc.


text: Depending on the environment, we employ strategies and practices designed to protect and mitigate cybersecurity material risks to our Information Systems and Data, including but not limited to: • Utilizing third-party tools to monitor threats and cybersecurity vulnerabilities, reduce risk, and enhance governance, risk, and compliance management. • Engaging a managed cybersecurity service provider to monitor and assess cybersecurity threats, serve as a point of contact for incident notification, and collaborate with our in-house IT team. • Maintaining security policies, procedures, and standards considering evolving threats and industry standards. • Engaging external subject matter experts and advisors to inform us of current cyber practices, policies, and programs. • Conducting tabletop exercises focused on scenarios such as ransomware, disaster recovery, and business continuity. • Providing mandatory annual security and privacy awareness training to all employees who have access to company email and connected devices. • Conducting phishing simulations and cyber hygiene training sessions to educate employees and promote responsible cybersecurity practices. • Maintaining an incident response plan and conducting tabletop exercises.

companyName: SI-BONE, Inc.

ticker: SIBN


text: We face various cybersecurity threats, including denial-of-service attacks, ransomware, phishing, and advanced persistent threats. In addition, as an aerospace and defense company that provides sophisticated defense products and services to the U.S. and foreign governments, we are also subject to cybersecurity risks from organized adversaries, including groups affiliated with various nation states. Our customers, suppliers, subcontractors and vendors also face similar threats. Cybersecurity incidents impacting us or any of these third parties could have a material adverse effect on our operations, financial condition and results of operations. Given the cybersecurity risks we face, we believe it is imperative that we dedicate ample resources to addressing and mitigating our cyber risks.

companyName: AeroVironment Inc

ticker: AVAV


text: We leverage qualified third-party consultants, advisors, counsel, and other experts to inform, audit, and update our Cybersecurity Program throughout each year. We engage security assessors to identify vulnerabilities through both internal and external penetration tests and to perform cybersecurity maturity assessments. We perform risk assessments annually, or more frequently if circumstances require, using both internal and external resources. We may also be subject to examinations by applicable regulators. We conduct annual cybersecurity training for employees to enhance awareness of how to detect and respond to cybersecurity threats, as well as periodic phishing training and testing campaigns. We also conduct table-top exercises annually to simulate a response to a cybersecurity incident.

companyName: Gold.com, Inc.

ticker: GOLD


text: Our cybersecurity awareness program includes regular phishing simulations, annual general cybersecurity awareness training, and data protection modules, as well as more contextual and personalized modules for targeted users and roles. We incorporate external expertise and guidance in all aspects of our cybersecurity program. We complete annual internal security audits and vulnerability assessments of the Company's information systems and related controls, including systems affecting personal data. In addition, we leverage cybersecurity specialists to complete annual external audits and objective assessments of our cybersecurity program and practices, including our data protection practices, as well as to conduct targeted attack simulations. We continually enhance our information security capabilities in order to protect against emerging threats, while also increasing our ability to detect and respond to cyber incidents and maximize our resilience to recover from potential cyber-attacks. We have a robust incident response plan in place that provides a documented runbook for handling high severity cybersecurity incidents and facilitates coordination across various corporate functions. We also perform simulations and drills at both a technical and leadership level at least annually. Additionally, we have purchased network security and cyber liability insurance in order to provide a level of financial protection should a data breach occur.

companyName: RALPH LAUREN CORP

ticker: RL


text: To date, we do not believe we have encountered cybersecurity threats or previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures will be sufficient, and that we will not be materially affected in the future. While we have customary insurance coverage in place designed to address certain cybersecurity risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise. For more information regarding our cybersecurity risks, see "Technology and Cybersecurity Risks" included as part of our risk factor disclosures in Part I, Item 1A of this report.

companyName: DIGI INTERNATIONAL INC

ticker: DGII


text: Our Senior Vice President, Cloud Security and Head of Global Information Security is supported by team members who have relevant educational and industry experience. These team members provide regular reports to the Senior Vice President, Cloud Security and Head of Global Information Security and work closely with our Chief Privacy Officer and include personnel dedicated to information security, product security, and physical security. Informed by the processes and practices discussed under "Risk Management and Strategy" above, team members escalate cybersecurity threats and incidents to the Senior Vice President, Cloud Security and Head of Global Information Security who assesses the severity of such threats and incidents for inclusion in quarterly update to the F&A Committee where appropriate. In addition to the ordinary-course Board and F&A Committee reporting and oversight described above, we also maintain disclosure controls and procedures designed for prompt reporting to the Board and timely public disclosure, as appropriate, of material events covered by our risk management framework, including cybersecurity risks.

companyName: ORACLE CORP

ticker: ORCL


text: As part of our risk management process, we engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. In addition, we engage outside providers to conduct annual internal and external penetration testing.

companyName: iTeos Therapeutics, Inc.


text: There have been no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. The nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches could have a material adverse effect on the Company's business, financial conditions or results of operations. For more information about the cybersecurity risks we face, refer to the Risk Factors in section "Information Technology and Cybersecurity Risks" in Part I, Item 1A, "Risk Factors".

companyName: TREES Corp (Colorado)

ticker: CANN


text: To date, we have not experienced a cybersecurity incident that resulted in a material adverse effect on our business strategy, results of operations or financial condition; however, there can be no guarantee that we will not experience such an incident in the future.

companyName: RESERVE PETROLEUM CO

ticker: RSRV


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While Lockheed Martin maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: LOCKHEED MARTIN CORP

ticker: LMT


text: The Corporate Governance and Nominating Committee of our Board of Directors oversees management of risks associated with corporate governance, including cybersecurity. This committee meets regularly with Corcept management and reports to the full Board of Directors.

companyName: CORCEPT THERAPEUTICS INC

ticker: CORT


text: We have also established a vulnerability management program to address the identification, prioritization, and remediation of potential cybersecurity vulnerabilities. These procedures allocate responsibility among various members of our cybersecurity team to detect vulnerabilities, assess their urgency, backup appropriate systems, and prioritize, select, test, and verify remediation methods. We hold vulnerability management meetings with our internal technical and business partners and regularly review these procedures.

companyName: CNX Resources Corp

ticker: CNX


text: Our CEO, MIS consultant, and MIS supervisor oversee risk management to ensure that the Company's policies and procedures are functioning as intended to protect the Company's information systems from cybersecurity threats.

companyName: Jerash Holdings (US), Inc.

ticker: JRSH


text: At Rapid7, cybersecurity risk management is integrated into our overall enterprise risk management program and one pillar of our broader cybersecurity program. Our cybersecurity risk management program is designed based on prevailing security standards and controls, such as NIST-800 and ISO 27001, and to continuously evaluate cybersecurity risks in alignment with our business objectives and operational needs. Our information security team manages a framework for handling both information security risk management and operational cybersecurity threats and incidents, including those associated with the use of products and services provided by third-party service providers, suppliers, and vendors. This framework includes steps for assessing the severity of a cybersecurity threat or incident, identifying the source of such cybersecurity threat or incident (including whether such cybersecurity threat or incident is associated with a third-party service provider, supplier, or vendor), implementing cybersecurity countermeasures and mitigations and an escalation path for informing management, the audit committee of the board of directors (the "Audit Committee"), and our full board of directors (the "Board") of cybersecurity threats, incidents and risks.

companyName: Rapid7, Inc.

ticker: RPD


text: While our Board and Technology and Cybersecurity Committee oversee cybersecurity risk, our senior leadership is responsible for identifying, assessing and managing our material risks from cybersecurity threats. Our IT organization, which is led by our Chief Information Officer, is accountable for our overall cybersecurity risk management program. Reporting to our Chief Information Officer is the individual who provides day-to-day oversight of our cybersecurity program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers, our CISO. Our CISO has an undergraduate degree in computer science and 30 years of experience in the IT, engineering and cybersecurity space. He has been with the Company since 2017, and previously served in management roles overseeing cybersecurity and security architecture at both publicly traded and private companies in the technology and software development industries. Our CISO is a recognized leader in the cybersecurity industry and often speaks at notable events throughout the world. The team that runs our cybersecurity risk management program comprises IT security, IT infrastructure and IT compliance personnel, who have prior work experience in various roles involving information technology (such as security, auditing, compliance, systems or programming) and/or relevant education or certifications.

companyName: SolarWinds Corp


text: As part of our commitment to information security and data protection, we have achieved SOC 2 Type II certification in 2024. This certification, issued by an independent third-party auditor, verifies that our security controls meet the American Institute of Certified Public Accountants (AICPA) Trust Services Criteria for security, availability, processing integrity, confidentiality, and privacy. The SOC 2 Type II audit evaluates the effectiveness of our cybersecurity and IT controls over an extended period, further validating our commitment to safeguarding sensitive information and maintaining a secure operational environment.

companyName: Korth Direct Mortgage Inc.


text: In considering the materiality of an Incident the CDC may consider the nature, extent and potential magnitude of the risks to the Company related to the Incident, particularly as it may relate to any compromised information or the business and scope of Company operations. If the CDC determines the Board should be notified, a meeting will be called with the Executive Committee of the Board, the Audit Committee Chair, the Board's cybersecurity expert or any combination or subset of the foregoing.

companyName: ROBERT HALF INC.

ticker: RHI


text: Maintaining a robust cybersecurity strategy to safeguard and protect the confidentiality, integrity and availability of our critical infrastructure assets as well as all other information systems and the information residing in them is critically important to our business. We face various cyber threats, including malware intrusion, computer viruses, unauthorized access attempts, ransomware attacks, social engineering attacks, hacktivism and insider threats. In addition to the cybersecurity threats faced by any business with a cyber presence, as an owner and operator of critical infrastructure assets, we are subject to cybersecurity threats from domestic and foreign threat actors who wish to disrupt our electricity delivery operations and/or the ERCOT bulk power grid. With an ever-increasing share of our operational and administrative activity being dependent on our information systems, we strive to create a company-wide culture of cyber safety that continually monitors risk.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: Our process also addresses material risks from cybersecurity threats associated with our use of third-party service providers, including those in our supply chain, our product development partners, or those who have access to sensitive data or our systems. Third-party risks are included within our broader overall risk assessment process, and cybersecurity considerations are considered during the selection and oversight of our third-party service providers.

companyName: I-ON Digital Corp.

ticker: IONI


text: Our cybersecurity risk management program utilizes information and guidance derived from industry-recognized frameworks, including the International Organization for Standardization (ISO) 27001 Framework and the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 (CSF), specifically the NIST 800-53 and NIST 811-171 publications. While we have based our cybersecurity risk management program on these frameworks, we have not obtained these specific certifications to date. Our cybersecurity risk management program is overseen by our Chief Information Officer ("CIO"), our First Vice President Information Security ("FVPIS") and our Senior Vice President Information Technology Shared Services ("SVPITSS") and reviewed annually.

companyName: PRICESMART INC

ticker: PSMT


text: Following a cybersecurity incident, and during its investigation and the formulation of a response, our processes also envision measures designed to contain and/or eradicate the incident and prevent further effects. Once it is determined that the incident has been resolved, we then work to establish appropriate controls (if applicable) to address similar future events and/or prevent another similar event from occurring in the future. To date, we have not experienced any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: Monroe Capital Income Plus Corp


text: HighPeak Energy maintains a cybersecurity program that aims to protect the confidentiality, integrity, and availability of data required by our business to be stored, analyzed, transported, and/or processed. The Company has implemented various internal and external controls and processes, including internal risk assessment and policy implementation, to incorporate a risk-based cybersecurity framework to identify, monitor and mitigate security threats and other strategies to increase security for our information, facilities, and infrastructure.

companyName: HighPeak Energy, Inc.

ticker: HPK


text: The IT Steering Committee is responsible for overseeing the Company's information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The ISO and SVP/IT Manager provide quarterly reports to the IT Steering Committee regarding the information security program and the technology program, key enterprise cybersecurity initiatives and other matters relating to cybersecurity processes. The IT Steering Committee reviews and approves the information security and technology budgets and strategies annually. Additionally, the Audit Committee reviews key metrics summarizing the Company's cyber security risk profile on a quarterly basis. The IT Steering Committee and Audit Committee each provide a report of their activities to the full board of directors at least annually.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Our Vice President and Head of Information Technology and our management committee on cybersecurity oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Vice President and Head of Information Technology is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents by leading cybersecurity risk management and working directly with our IT team. Our Vice President and Head of Information Technology also provides appropriate information and updates to our management committee on cybersecurity.

companyName: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.

ticker: PACB


text: Our cybersecurity risk management program incorporates multiple components, including, but not limited to, ongoing monitoring of critical risks from cybersecurity threats using automated tools. Additionally, we have implemented an employee education and training program, which we provide on an annual basis, that is designed to raise awareness of cybersecurity threats. To support our cybersecurity risk management program, we leverage managed service providers and other third-party information technology and cybersecurity providers and consultants, including to perform regular system scans and threat intelligence analysis. Additionally, we require certain third-party providers and consultants to adhere to contractual requirements relating to privacy and cybersecurity standards.

companyName: Lifeward Ltd.

ticker: LFWD


text: The company engages consultants and other third parties to identify and manage cybersecurity risks, including risks from third-party service providers that may impact the company.

companyName: FLOWERS FOODS INC

ticker: FLO


text: We design and assess our program based on the U.K. Cyber Essentials and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Mereo BioPharma Group plc

ticker: MREO


text: In the past, we have experienced targeted and non-targeted cybersecurity attacks and incidents, and we could in the future experience similar attacks. To date, no cybersecurity attack or incident, or any risk from cybersecurity threats, has materially affected or has been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition.

companyName: Rayonier, L.P.


text: Material findings, notable weaknesses and suggestions are presented to the Enterprise Risk and Compliance Committee of the Company's Board of Directors (the "ERC Committee") as discussed below.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: As of the date of this filing, we have not experienced any risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. However, future threats or incidents could have a material impact on our business strategy, results of operations or financial condition. For a discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Part I, Item 1A. "Risk Factors—Risks Related to Our Company—Maintaining cybersecurity and data security is important to our business and a breach of our cybersecurity or data security could result in serious harm to our reputation and have a material adverse impact on our business and financial results" and "— We are highly dependent on information systems, and system failures could significantly disrupt our business, which may, in turn, have a material adverse effect on us." We maintain a cybersecurity insurance policy to mitigate risks associated with cybersecurity incidents.

companyName: Angel Oak Mortgage REIT, Inc.

ticker: AOMR


text: Our Board of Managers retains supervisory oversight responsibility for enterprise risk management and cybersecurity risks. The primary responsibility for maintaining an information security has been assigned to an Information Security Officer (" ISO "). The ISO works with the Audit Committee to address information security risks found by each business segment. Our ISO conducts an annual risk assessment report and submits the report to the Audit Committee for its review. The Audit Committee meets with Company management, the ISO and external auditors to review the Company's risk management processes and enterprise-wide risks found by the Company. The scope of this review is intended to address cybersecurity governance risks and related controls and identify any deficiencies that could adversely affect the Company's ability to record, process and report financial data. As of the date of this Report on Form 10-K, there have been no cybersecurity incidents we believe have had a material effect on our operations, business, results of operations or financial condition.

companyName: MINISTRY PARTNERS INVESTMENT COMPANY, LLC


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security protocols and controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security protocols and controls; • Cybersecurity awareness training of our employees, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for assessing and responding to cybersecurity incidents; and • A third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.

companyName: Warby Parker Inc.

ticker: WRBY


text: Our day-to-day cybersecurity risk management and strategy processes are overseen by representatives from our IT, finance, and legal departments. Such individuals have an average of over 15 years of prior work experience in various roles involving IT security, auditing, compliance, data protection, privacy, risk management, systems, and programming. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, our cybersecurity risk management and strategy processes, and report to the audit committee on any appropriate items.

companyName: Caribou Biosciences, Inc.

ticker: CRBU


text: The second line of defense is provided by the Enterprise Risk Management department (led by the Company's Independent Chief Risk Officer ("CRO")) and the CISO (reporting to the CIO). The second line of defense seeks to identify, assess, and monitor cyber risk, in collaboration with our first line, while maintaining independence in the oversight of our information security program. The CISO has dotted-line reporting to the CRO. The CRO is independent of management and reports to the Board Risk Committee Chair.

companyName: Capital Bancorp Inc

ticker: CBNK


text: The Company engages third party consultants with respect to cybersecurity, including to conduct vulnerability assessments and penetration testing of its information technology systems. The Company has established a regular vendor risk management process to evaluate and address potential risks associated with the use of such third parties.

companyName: BERKLEY W R CORP

ticker: WRB


text: Our CISO and the Head of Software regularly report on cybersecurity and product security matters, respectively, to the Audit Committee and/or the Technology and Innovation Committee and the Board of Directors.

companyName: LOGITECH INTERNATIONAL S.A.

ticker: LOGI


text: The company does not have a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters.

companyName: AXIM BIOTECHNOLOGIES, INC.

ticker: AXIM


text: Protecting our technology and information systems: We use various tools to help manage our overall program including unauthorized access detection, 24x7 security monitoring, email protection, network intrusion prevention systems, security training, penetration testing, and other similar tools to protect the Company's data. When adopting or changing technology, we conduct risk-based security and privacy impact assessments and deploy administrative, physical, and technical safeguards that are designed to reasonably protect us from cybersecurity threats. We actively monitor and proactively research potential cybersecurity threats to our technologies and information systems and use what we learn to evolve our security controls over time to mitigate risks posed by such threats.

companyName: Hillenbrand, Inc.

ticker: HI


text: The Company has what it believes are appropriate physical, technical, and administrative controls in place that are designed to protect customers' data. The Company uses a three-pronged approach focused on further reducing exposure, raising greater security awareness, and further strengthening the Company's cybersecurity defenses. This approach resulted in the Company further hardening its identity computing environments as part of its progress to a zero trust environment, heightened cybersecurity awareness efforts through increased comprehensive information security awareness training for employees on a quarterly basis, and the strengthening of the Company's cybersecurity defenses through implementation of multifactor authentication for Privileged Access Management and Endpoint Detection and Response solutions across the Company's computing environment.

companyName: OMNICELL, INC.

ticker: OMCL


text: Our management stays informed about cybersecurity developments and threats through internal and external threat intelligence, third-party risk assessments, and continuous monitoring systems deployed across the enterprise.

companyName: e.l.f. Beauty, Inc.

ticker: ELF


text: Our information security program and team are currently managed by our Chief Information Security Officer ("CISO") who reports to our Chief Technology Officer. Our CISO has more than 25 years of experience in managing and leading cybersecurity functions including cybersecurity operations, strategy and governance, and information technology and security risk, compliance, and audit responsibilities across the U.S., Latin America, United Kingdom, Eastern Europe, Singapore, and China. Our CISO is responsible for developing, implementing, and overseeing our overall information security program, including cybersecurity risk management, governance and compliance, security policies and training, and the overall protection and defense of our networks, systems, and confidential data. With respect to risk management, our CISO works closely with our Managing Director, Risk Management, and other members of our Risk Committee, who are responsible for reviewing and challenging, as necessary, the activities of our information security team.

companyName: BROADRIDGE FINANCIAL SOLUTIONS, INC.

ticker: BR


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.

companyName: ONTO INNOVATION INC.

ticker: ONTO


text: We also carry cybersecurity insurance to protect the Company in the event of a cybersecurity breach and to provide resources if a cybersecurity breach occurs.

companyName: TherapeuticsMD, Inc.

ticker: TXMD


text: Our Chief Information Officer (CIO) provides annual reports, with additional updates as necessary to the board of directors. Our CIO also attends annual audit committee meetings and provides cybersecurity updates which include specific cybersecurity topics, covering material risks and threats. Our CIO oversees the cybersecurity program. With an extensive background in the IT industry, our CIO has previously held CISO positions, and other top global leadership roles, that drove digital transformation and owned technology from end to end. Our CIO leads a cross-functional information security team, comprised of experienced professionals from the global infrastructure and cybersecurity, legal and compliance organizations. Beyond information technology, this leadership team also partners with our Enterprise Operations team managing the operational technology security of our manufacturing facilities.

companyName: DONALDSON Co INC

ticker: DCI


text: The CDO provides the Board with ongoing security updates, which include notable changes to program plans, changes to the risk environment, information regarding material incidents that may have occurred, reports on recent assessments of our security controls, and details regarding forward-looking plans and strategies to mitigate cyber risk.

companyName: MARINEMAX INC

ticker: HZO


text: Our CISO also regularly meets with our CEO and other senior management, including as part of the cybersecurity incident response process.

companyName: Snap Inc

ticker: SNAP


text: Cybersecurity is an area of increasing concern to the management of and investors in CPS. While CPS has been International Traffic in Arms Regulations (ITAR) compliant for many years, that in itself does not mitigate the risks of a cybersecurity incident. The Company is currently also working towards full compliance with NIST 800 - 171 as well as CMMC compliance. In working towards this goal, CPS has retained an outside consulting firm to help us implement the policies, processes and procedures to further mitigate cybersecurity risks.

companyName: CPS TECHNOLOGIES CORP/DE/

ticker: CPSH


text: As part of its broader risk oversight activities, the Board oversees risks from information security threats, both directly and through the Audit Committee of the Board (the "Audit Committee"). As reflected in its charter, the Audit Committee assists the Board in its oversight of risk by periodically reviewing policies and guidelines with respect to risk assessment and risk management, including management reports on our processes to manage and report risks. As another element of its risk oversight activities, the Audit Committee receives reports quarterly from our Global Chief Information Officer ("CIO") and Global Chief Information Security Officer ("CISO") on the execution and effectiveness of our cybersecurity and privacy program, cybersecurity incidents, cyber resilience metrics and the global threat landscape. The Audit Committee also oversees our internal control over financial reporting, including with respect to financial reporting-related information systems.

companyName: WHIRLPOOL CORP /DE/

ticker: WHR


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: TSS, Inc.

ticker: TSSI


text: The Company maintains a risk-based approach to identifying and overseeing risks from cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company's systems as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Axsome Therapeutics, Inc.

ticker: AXSM


text: Third-parties on Risk Management the complexity and evolving nature of cybersecurity threats, we engage with external experts, including cybersecurity assessors, consultants, and auditors, in evaluating and testing our risk management systems. These service providers enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices.

companyName: Biostax Corp.


text: We protect our information assets and manage risk by promoting a culture that communicates security risks, designs secure IT systems and operates according to approved processes to reduce the likelihood and impact of security incidents. We achieve this objective by: designing, implementing and maintaining solutions with appropriate security controls; sustaining solutions with required patching and vulnerability remediation; creating and executing controls in support of policy as well as regulatory compliance;

companyName: Anixa Biosciences Inc

ticker: ANIX


text: Our Board actively oversees our corporate strategy and enterprise risk management ("ERM") programs, including those relating to cybersecurity and data privacy risks.

companyName: Lantheus Holdings, Inc.

ticker: LNTH


text: The Partnership has an enterprise-wide business resiliency program, policy and framework to assist in planning for, and mitigating disruption to the Partnership's business operations from, incidents including cybersecurity events, through risk assessment, business impact analysis, response plan development, training, testing, and ongoing maintenance. The Business Resilience Department is responsible for creating and maintaining the Partnership's business resilience policy and framework and overseeing the program's implementation in collaboration with sponsors and leaders from the Firm's business areas. A Business Resilience Oversight Group comprised of general partners meets at least semi-annually and provides oversight of business resilience strategy, risk management, resources, performance, and integration into business processes. Elements of business continuity plans vary based on the nature of the processes involved and the impacts of the incident but can include planning related to human capital, real estate, third-party relationships and technology infrastructure. As part of its business resiliency planning, the Partnership has data centers in two geographically distinct locations and its third-party vendors have data centers in several regions of the United States. A prolonged interruption at any site or of critical systems or software may result in an extended delay of service to the Partnership's clients and substantial costs and expenses.

companyName: JONES FINANCIAL COMPANIES LLLP


text: Other Committees. In addition to the SCC and Risk Committees, we have established a Technology Committee, a Senior Management Committee, and a Business Continuity and Disaster Recovery (BC/DR) Committee. Each oversees aspects of our ISSP and coordinates with the SCC to implement various cybersecurity procedures.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Our management, including the REIT Manager's Chief Compliance Officer and CSC, is authorized to take the appropriate steps deemed necessary to identify, assess, contain, mitigate, and resolve cybersecurity threats including by (a) maintaining (i) an Incident Response Plan in the event of an Incident and (ii) a Cybersecurity Policy which governs information technology security policies, (b) regularly monitoring all our systems and user accounts for any suspected Incidents, (c) performing annual audits on certain of our systems, and (d) providing general cybersecurity awareness and data protection training. In addition, depending on the circumstances of an Incident, we may engage third parties such as insurance carriers, outside legal counsel, forensic investigators, crisis communications or public relations firms, investor relations firms and response vendors and we may coordinate with regulators or law enforcement. We perform due diligence in order to identify and evaluate cyber risks of third party service providers. Third party service providers processing sensitive data are contractually required to meet applicable legal and regulatory obligations to protect sensitive data against cybersecurity threats and unauthorized access to the sensitive data. Third party service providers deemed critical undergo ongoing monitoring to ensure they continue to meet their security obligations and other potential cybersecurity threats.

companyName: Terra Income Fund 6, LLC

ticker: TFSA


text: We have not encountered any cybersecurity threats or incidents to date that have materially affected, or that are reasonably likely to materially affect, our business, strategy, results of operations or financial condition. For additional information regarding cybersecurity risks and their potential impacts on our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.

companyName: Alector, Inc.

ticker: ALEC


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, including the Company's business strategy, results of operations or financial condition.

companyName: INTENSITY THERAPEUTICS, INC.

ticker: INTS


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Information Security Steering Committee which meets quarterly to review cybersecurity matters. Our Information Security Steering Committee is comprised of our Chief Information Security Officer, our CEO, CFO, COO, Chief Legal Officer, Vice President of Human Resources and Vice President of Information Technology. At the management level, our CISO, who reports to our Chief Information Officer, is responsible for overseeing the assessment and management of our material risks from cyber security threats. Our CISO has extensive experience and knowledge in cyber security with over 25 years of experience in leading security teams, developing security strategies, and managing risk across various industries. Our CISO has operated in this capacity at three other public companies and our CIO has over 25 years of information technology experience and managing cybersecurity risk including at other public companies.

companyName: Enovix Corp

ticker: ENVX


text: Breeze employs additional measures within the cybersecurity risk management program including identity access management controls such as restricted access of privileged accounts, periodic reviews of user access, and segregation of duties and anti-malware/anti-virus tools.

companyName: Breeze Holdings Acquisition Corp.


text: Role of Management The Chief Information Officer oversees the activities of our IT and information security teams. Our Chief Information Officer has been with Paycom since 2005 and has more than 30 years of IT and software development experience. The Executive Vice President of IT and Information Security, who reports to our Chief Information Officer, is responsible for ensuring that both new implementations and ongoing operations comply with the policies, procedures, and guidelines of our information security program. Our Executive Vice President of IT and Information Security has been with Paycom for over a decade and has worked in technology development, improvement, infrastructure, and security for over 25 years. The Executive Vice President of IT and Information Security is supported by our Director of IT Security, who has worked in technology development, improvement, infrastructure, and security for over a decade. The Director of IT Security is responsible for the growth and implementation of the information security and data privacy programs and oversees the operations of the information security team. The Director of IT Security also provides oversight for information security and privacy policies and controls, oversees compliance activities, and provides metrics and guidance to executive management regarding the program. The aforementioned leaders and teams have a breadth of experience and manage programs related to governance, risk, and compliance; data privacy and security; vulnerability management; security operations; and application security.

companyName: Paycom Software, Inc.

ticker: PAYC


text: Our cybersecurity team proactively hunts for cyber threats and vulnerabilities in our networks and information systems as part of our cyber risk management program, including by monitoring our networks and systems for intrusions and other suspicious activity. The cybersecurity team stays apprised of existing and emerging cybersecurity threats, including by partnering with third parties, such as the U.S. government, law enforcement agencies, customers, and other defense industry participants to share and receive information on emerging threats and expanding our cybersecurity knowledge and global monitoring practices. We also engage third parties to conduct evaluations of our cybersecurity controls, such as penetration testing and controlled cybersecurity framework audits. We also review the cybersecurity practices of our third-party service providers.

companyName: AeroVironment Inc

ticker: AVAV


text: Our board of directors, through its Audit & Risk Committee, provides oversight and oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Management, including our vice president of technology, and our Audit & Risk Committee members, of which two members of our committee have received training and certifications on cyber risk governance for public companies, regularly brief our board of directors on our cybersecurity and information security posture as well as cybersecurity incidents deemed to have a moderate or higher business impact, even if viewed as immaterial to us. As cyber threats evolve and become more sophisticated, we believe that the board's involvement in cybersecurity governance ensures that we are adequately focused on resources and protecting the Company's assets and reputation.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: Our incident response plan is designed to escalate certain cybersecurity incidents to members of our incident response team and members of management depending on the circumstances, including executive management and the Board. Our Senior VP of Global IT and System Operations, IT Security Officer and information security team work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan includes reporting to the Governance and Compliance Committee ("the Committee") for certain cybersecurity incidents. The Committee periodically evaluates overall business continuity, compliance, regulatory, quality and safety systems effectiveness.

companyName: ENZO BIOCHEM INC


text: Forming an IT Cybersecurity Committee (ITCC), which consists primarily of members of our management team and IT department, to develop and oversee our cybersecurity policies and infrastructure and establishing a multi-tiered reporting and governance system pursuant to which our ITCC reports to our Service Center Board, which reports to our Risk Committee, which reports to our Board;


text: Risk Management and Strategy Enterprise Risk Management. We utilize an enterprise risk management process undertaken on an ongoing basis pursuant to which we seek to identify various enterprise risks related to product safety and regulatory, global environmental exposure, site environmental matters, IT system interruption and cybersecurity, supply chain matters, business continuity, health and safety incidents and other matters. We have an enterprise risk management group that manages this process, which includes our executive leadership team. Their activities include assessing the risks, prioritizing the risks, measuring the risks, implementing mitigation plans and auditing the results.

companyName: SOMNIGROUP INTERNATIONAL INC.

ticker: SGI


text: As part of the Company's cybersecurity risk management process, the Company conducts an annual "tabletop" exercise during which the Company simulates cybersecurity incidents to ensure that the Company is prepared to respond to such an incident and to highlight any areas for potential improvement in the Company's cyber incident preparedness. This exercise is conducted at both the technical level and senior management level. In addition, all employees are required to pass mandatory cybersecurity training courses on an annual basis and receive bi-weekly phishing simulations to provide "experiential learning" on how to recognize phishing attempts.

companyName: FIRST MID BANCSHARES, INC.

ticker: FMBH


text: XPEL faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Company has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Company's business, financial condition, results of operations, or cash flows.

companyName: XPEL, Inc.

ticker: XPEL


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program and cybersecurity is a critical element of this program. The Audit Committee of our Board oversees management of risk, including cybersecurity and the management of cybersecurity threats. This committee meets regularly with the Company's management and reports to the full Board. Management is responsible for the day - to - day administration of our risk management program and our cybersecurity policies, processes, and practices. Our cybersecurity policies, standards, processes, and practices are integrated into our overall risk management system and processes. In general, we seek to address material cybersecurity threats through a company - wide approach that addresses the confidentiality, integrity, and availability of our information systems or the information that we collect and store, by assessing, identifying and managing cybersecurity issues as they occur. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity risk that meets pre - established reporting thresholds, as well as ongoing updates regarding any such risk. Our CEO and CFO each have over 25 years of experience managing risk at the Company and at similar companies.

companyName: SEELOS THERAPEUTICS, INC.


text: Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CISO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Fastly, Inc.

ticker: FSLY


text: No risks from cybersecurity threats nor any previous cybersecurity incidents have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, but we cannot provide any assurance that they will not be materially affected in the future by such risks or incidents. For a discussion of whether and how any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, see "Risks Relating to Our Business: Other––Increased IT security threats and more sophisticated and targeted computer crime could pose a risk to our systems, networks, products, solutions and services" in Item 1A, Risk Factors.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: Our information technology security professionals who work closely with our Chief Technology Officer ("CTO") who is responsible for the detection and initial assessment of cybersecurity threats and incidents (collectively, "cyber incidents"), whether internal or experienced by significant third-party service providers, using, among other means, third-party software. The team classifies detected cyber incidents based on potential impact to the functionality of the affected systems, possible or known information involved, and recoverability effort. The classification of a cyber incident is designed to allow rapid prioritization, response, and escalation. The CTO and Chief Executive Officer ("CEO") are alerted as to any detected cyber incident that is potentially significant. Incidents are documented for regular internal reporting processes including notations and considerations of related attacks.

companyName: ACCESS Newswire Inc.

ticker: ACCS


text: The Company's security awareness program seeks to create a culture of shared responsibility for the security of sensitive data and systems. This is accomplished through mandatory annual security training for team members with access to Company email as well as tailored training for team members in more sensitive roles. Periodic testing ensures the training is effective. In addition, all team members have access to a variety of training materials on security topics through the Company's training management system.

companyName: TRACTOR SUPPLY CO /DE/

ticker: TSCO


text: Our cybersecurity risk management processes include assessing third-party risks and we regularly perform third-party risk assessments to help us identify and mitigate risks arising from our use of or partnership with third parties, such as vendors, suppliers, and other business partners. Third-party cybersecurity risks are also evaluated as part of our initial due diligence assessments upon engaging third-party providers, inclusive of potential fourth-party risks related to the handling and processing of employee, business, or customer data. In addition to due diligence procedures conducted during onboarding of new third-party providers, we perform annual risk assessments of key third-party providers, along with real-time assessments in accordance with our Incident Response Plan and procedures, as needed, to help us determine any potential impact to the Company from third-party cybersecurity incidents that come to our attention.

companyName: Open Lending Corp

ticker: LPRO


text: The Firmwide Operational Risk and Resilience Committee is responsible for overseeing operational risk and seeks to ensure business and operational resilience.

companyName: Goldman Sachs Physical Gold ETF

ticker: AAAU


text: Additionally, the Technology Committee of our board of directors reviews our cyber security risk profile on at least an annual basis.

companyName: Tectonic Financial, Inc.

ticker: TECTP