text: Board Oversight of Cybersecurity Risks Our Board provides strategic oversight on cybersecurity matters, including material risks associated with cybersecurity threats. Our Board receives periodic updates from our Chief Compliance Officer regarding the overall state of our cybersecurity program, information on the current threat landscape, and material risks from cybersecurity threats and cybersecurity incidents.

companyName: Chicago Atlantic BDC, Inc.

ticker: LIEN


text: Our Board of Directors fully aware of the importance of cybersecurity. Furthermore, Board of Directors responsible for supervising data privacy and cybersecurity risks. They routinely examine the Company's cybersecurity initiatives with management, assessing the sufficiency of controls and security measures for our information technology systems.

companyName: Leet Technology Inc.

secItem: Item 1C


text: The CISO is charged with the continuous evolution of the Program to address emerging threats and new technologies, ensuring that we can adapt to the everchanging risk environment and those who seek to compromise our information. As such, the Program is regularly evaluated by both internal and external assessors to ensure its effectiveness by measuring its ability to prevent risk realization.

companyName: Rocket Companies, Inc.

ticker: RKT


text: The audit committee receives periodic reports from the CFO concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: AETHLON MEDICAL INC

ticker: AEMD


text: IT Manager provides timely reports on cyber security incidents to the FSO, Danny Schoening, who also serves as the Chief Executive Officer and as Chairman of the board of directors. These reports may in turn be presented to the full board depending on the severity of the incident. In the event of a major incident, the Company's Incident Response policy will be executed and the appropriate parties notified.

companyName: Optex Systems Holdings Inc

ticker: OPXS


text: Our audit committee of the Board of Directors provides direct oversight over cybersecurity risk and provides applicable updates to the Board of Directors regarding such oversight. Members of management responsible for data privacy, technology, and information security risks join our audit committee meetings from time to time to discuss these risks, risk management activities, incident response plans, best practices, the effectiveness of our security measures, and other related matters.

companyName: Replimune Group, Inc.

ticker: REPL


text: Our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with our Chief Information Security Officer ("CISO"), Chief Privacy Officer, Cyber team, Legal team, Physical Security team, and Content Management team, to gather insights for identifying and assessing cybersecurity threats, their severity, and potential mitigations. We conduct monthly Cyber Risk Committee meetings with the participation of these teams to review risks in each of those functions and any cross-functional risks.

companyName: Warner Music Group Corp.

ticker: WMG


text: Our ITSS team is led by our CISO, who reports to our Executive Vice President and Chief Financial Officer. Our CISO is a former CPA that has 35 years of experience in leading global accounting and business information systems groups including strategy, applications, infrastructure, information security, support, and execution.

companyName: MICROCHIP TECHNOLOGY INC

ticker: MCHP


text: Senior management plays a pivotal role in informing the Audit Committee on cybersecurity risks. The information technology department regularly informs the Chief Financial Officer (CFO) of all aspects related to cybersecurity risks and incidents. This ensures that senior management is kept abreast of the cybersecurity posture and potential risks. The senior management team presents updates to the Audit Committee quarterly and, as necessary, to the full Board. These regular reports include detailed updates on the Company's performance preparing for, preventing, detecting, responding to and recovering from cyber incidents, if applicable.

companyName: GORMAN RUPP CO

ticker: GRC


text: We rely on our information technology to operate our business and provide our Barostim Therapy to patients. We have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: CVRx, Inc.

ticker: CVRX


text: The information security team is made primarily of full-time employees; however, we routinely engage consultants to provide supplemental labor and additional expertise in specific areas on an as-needed basis. Our information security team is organized based on industry best practices in alignment with NIST recommendations. All of the leaders in our information security team have over 10 years of cybersecurity experience and most of our information security staff maintain cybersecurity program certifications such as CMU Cybersecurity Executive Certification, ISACA Certifications (CISSP & CISM) and other relevant vendor certifications. Our information security team also regularly undergoes continuing education to ensure our implementation of best-in-class techniques.

companyName: IRON MOUNTAIN INC

ticker: IRM


text: In addition, we maintain policies over areas such as information security, incident management, business continuity, IT change and configuration management, acceptable use and access on/offboarding to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise. We engage with these partners to monitor and maintain the performance and effectiveness of IT assets, data, and services that are deployed in our IT environment.

companyName: Banzai International, Inc.

ticker: BNZI


text: We face cybersecurity risks in connection with our business (see Part I, Item 1A. "Risk Factors – Risks Related to our Operations – Our business depends on our information systems. A cyber-attack, security breach or our inability to effectively integrate, manage and keep our information systems secure and operational could disrupt our operations."). Although such risks have not materially impacted our business strategy, results of operations or financial condition to date, we have experienced threats to and breaches of our data and systems, including malware and computer virus attacks, and future such events or circumstances could have a material adverse effect on our business and consolidated financial condition, results of operations or cash flows.

companyName: AMEDISYS INC


text: Risk Factors in this Annual Report on Form 10-K, including "Any unauthorized access to or disclosure or theft of personal information we gather, store or use could harm our reputation and subject us to claims or litigation."

companyName: SunPower Inc.

ticker: SPWR


text: Our board of directors, in coordination with our audit committee, oversees our risk management process. Our audit committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our board of directors and audit committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a periodic basis, our board of directors and audit committee discuss our approach to cybersecurity risk management with our head of IT.

companyName: Stoke Therapeutics, Inc.

ticker: STOK


text: Tyler also utilizes technology to help harden our environment from internal and external threats. We leverage a third-party endpoint detection management solution and threat intelligence software, as well as web-filtering tools, a multi-factor authentication tool, and related tools that support our "defense-in-depth" strategy. These tools are operated by subject-matter experts that report to the CISO, and Tyler employees are educated on the tooling to the extent applicable.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: Under the oversight of the audit committee of the Company's board of directors, and as directed by the Company's Chief Executive Officer, the Company's Director of Information Technology (DIT) is primarily responsible for the assessment and management of material cybersecurity risks. The DIT has over 25 years of experience in information security, risk management, and compliance, has served essential security and audit roles at other organizations, is a member of InfraGard, and is a CISSP (Certified Information Systems Security Professional). The DIT is supported by members of senior management who provide cross-functional support for cybersecurity risk management and facilitate the response to any cybersecurity incidents.

companyName: Inuvo, Inc.

ticker: INUV


text: Our cybersecurity risk management program is informed by prevailing security standards and is designed to provide a framework for evaluating and responding to cybersecurity risks. This includes processes for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat, implementing cybersecurity countermeasures and mitigation strategies, and informing and updating management and, as needed, the Audit Committee and our Board of Directors of cybersecurity incidents that may pose a significant risk for the business. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality, as well as operational and business impact, and reviewed for privacy impact.

companyName: BrightSpring Health Services, Inc.

ticker: BTSG


text: Our process of assessing, identifying and managing material risks from cybersecurity threats is integrated into our overall enterprise risk management ("ERM") process. The audit committee of the board of directors (the "Audit Committee") oversees our ERM framework, including cybersecurity and other information technology risks. This involves collaboration with key personnel, including the Chief Financial Officer ("CFO"), the Chief Technology Officer ("CTO"), IT operational management, and Internal Audit. We also have a cross-functional team led by the CTO, which meets weekly with a fixed agenda to discuss mitigation and action-items related to ERM cyber risk updates, cyber statistics dashboards, and threat vectors. Our CTO has a comprehensive background in various enterprise-wide information technology and cybersecurity leadership roles within the global energy and oil and gas sectors, and strategy consulting. The Audit Committee receives a report from our Director of Internal Audit on the ERM risk register at least three times a year.

companyName: Great Lakes Dredge & Dock CORP

ticker: GLDD


text: In addition, Registrant's plans require members of its senior management, such as its CEO and CFO, as well as members of management from its, and its subsidiaries', Operations, Information Technology, Human Capital Management, Accounting and Legal teams participate in Registrant's Cybersecurity Incident Response Team ("CIRT") to be kept current on all aspects related to a cyber-attack, if a cybersecurity incident were to occur.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: Our cybersecurity program is led by a team of cybersecurity professionals. The program incorporates industry-standard frameworks, policies and practices designed to protect the privacy and security of our sensitive information. Senior members of our management, including our Head of Information Security and Chief Information Officer, each of whom has over 10 years of experience in various roles involving information technology, including security, auditing, compliance, systems and programming, are responsible for assessing cybersecurity risk. Risk management is performed by the senior leadership of the cybersecurity team as well as members of our legal and privacy teams where relevant. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation of our incident response plan. Additionally, our threat intelligence software issues a quarterly report briefing to inform the security team about relevant cybersecurity events, significant vulnerabilities and vendor-related incidents.

companyName: Guardant Health, Inc.

ticker: GH


text: The Committee receives periodic reports from management on potential cybersecurity risks and threats and receives presentations on cybersecurity topics from Vornado and its Chief Information Officer. The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.

companyName: ALEXANDERS INC

ticker: ALX


text: We are not aware of any cybersecurity risks, including as a result of any cybersecurity incidents during 2024, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Third parties with access to sensitive data or systems are subject to due diligence and ongoing monitoring.

companyName: Employers Holdings, Inc.

ticker: EIG


text: Considering the pervasive and increasing threat from cyberattacks, the Board and the Audit Committee, with input from management, assess the Company's cybersecurity threats and the measures implemented by the Company in an effort to mitigate and prevent cyberattacks. The Audit Committee consults with management regarding ongoing cybersecurity initiatives and requests management report to the Audit Committee or the full Board regularly on their assessment of the Company's cybersecurity program and risks. Both the Audit Committee and the full Board receive quarterly reports from the Chief Information Officer on cybersecurity risks and timely reports regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. Our Board has risk management experience, including members with experience in overseeing teams responsible for data security and cybersecurity and assessing technology-related risks and development of risk mitigation strategies.

companyName: TILE SHOP HOLDINGS, INC.

ticker: TTSH


text: We perform a formal cybersecurity risk assessment each year. As part of our risk assessment, we consider the potential for cybersecurity threats, including but not limited to interruptions, outages and breaches to our operational and financial systems. We have policies, processes, internal controls and tools to assess, identify, and manage material risks from potential cybersecurity threats. We engage third-party service providers, with significant information technology and cybersecurity experience, to assist with designing, implementing and managing our information technology infrastructure and cybersecurity program.

companyName: KalVista Pharmaceuticals, Inc.

ticker: KALV


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our overall risk management systems. These risks include, among other things: operational risks, encryption, intellectual property theft, fraud, extortion, harm to employees or other stakeholders, and violation of data privacy or security laws.

companyName: T1 Energy Inc.

ticker: TE


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We measure our cybersecurity infrastructure against the NIST 800-171 framework and routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: ESS Tech, Inc.

ticker: GWH


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. Our responsible offer is directly supervising our employees' compliance of our internal safeguards and she reports to our Chief Executive Officer periodically and on an as-needed basis to manage our risk assessment and mitigation process. We monitor and test our safeguards and regularly conduct training for our employees on these safeguards, in collaboration with human resources, IT, and management. We are committed to promoting a company-wide culture of cybersecurity risk management.

companyName: QDM International Inc.

ticker: QDMI


text: To proactively identify, mitigate, and prepare for potential cybersecurity incidents, we maintain a cyber incident response plan with formalized workflows and playbooks. We conduct simulation exercises involving employees at various levels of the organization. We also periodically engage external partners to conduct annual audits of our systems and test our Information Technology infrastructure. Through these channels and others, we work to proactively identify potential vulnerabilities in our information security system. We recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. To minimize the risk and vulnerabilities to our own systems stemming from such use, our Information Security team identifies, and addresses known cybersecurity threats and incidents at third-party service providers on a continuous basis. In addition, we strive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process.

companyName: Jasper Therapeutics, Inc.

ticker: JSPR


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: COHERENT CORP.

ticker: COHR


text: Management's Role Managing Risk We devote significant resources, and designate high-level personnel, including our Chief Information Security Officer ("CISO") and Data Protection Officer ("DPO"), who each report to our Chief Operations Officer ("COO"), to manage cyber-related risk assessment and mitigation processes. Our CISO, who has been leading the team for over a decade, has over 20 years of industry experience, is a Certified Information Systems Security Professional and lead ISO 27001 auditor, and has authored five books on information security auditing strategy, wired and wireless network security, and penetration testing Our CISO and our management committee on cybersecurity, which includes our Chief Executive Officer ("CEO"), COO and IT Director, are primarily responsible for assessing and managing our material risks from cybersecurity threats. They are assisted by dedicated information security and IT staff, our DPO, HR Director, and legal and finance representatives. Our current management committee on cybersecurity includes dedicated full-time specialists in relevant fields ranging from code, application, system, and network security to computer forensics, data privacy and applied cryptography, physical security, social engineering and red teaming.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: We have implemented and maintain a risk management framework designed to identify, assess, and mitigate risks from cybersecurity threats. We assess our cybersecurity program ("CSP"), as part of our enterprise risk management program, against the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF") and also use as a model the Center for Internet Security ("CIS") control framework's Implementation Group 2 ("IG2"). We perform annual assessments against NIST CSF benchmarks and focus on continuous improvement over those criteria. We use a list of factors based on business risk tolerance and external compliance requirements to determine if a business asset, data, system, process, or service provider should be included within the scope of the CSP. Prior to contracting with an outside vendor that hosts our data, such as Company information, or PII of our associates or residents, or that integrates with our systems, our policy is to conduct a cybersecurity risk assessment, which includes, as appropriate, a due diligence questionnaire completed by the vendor, a System and Organization Controls 1 ("SOC1") report from major vendors and a review of the vendor's scope of access to our IT systems and data.

companyName: AVALONBAY COMMUNITIES INC

ticker: AVB


text: Sharif Alexandre, Chief Technology Officer - Mr. Alexandre has over 20 years industry experience including managing Information Technology and Software Development teams at organizations ranging from technology startups to Fortune 500 companies. He recently oversaw IT operations and currently leads the Software Development and Data Management teams at the Bank.

companyName: ConnectOne Bancorp, Inc.

ticker: CNOB


text: Threats and Incidents To date, cybersecurity incidents have not materially affected us, including our business strategy, results of operations or financial condition. During fiscal 2025, fiscal 2024 and fiscal 2023, the Company did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company or its business strategy, results of operations and/or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced undetected cybersecurity incidents. For additional details regarding the risks the Company faces from cybersecurity threats, see "ITEM 1A. RISK FACTORS — Risks Related to Our Business — Our operations, financial condition or reputation may be impaired if our information or operational technology systems fail to perform adequately or if we are the subject of a data breach or cyber attack" in this Form 10-K.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: We recognize the importance of securing our data and information systems and have a process for assessing, mitigating, overseeing and managing cybersecurity and related risks. This process is supported by both management and our Board of Directors.

companyName: Ascent Solar Technologies, Inc.

ticker: ASTI


text: Our Board maintains oversight responsibility relating to our Program, with assistance from the Audit Committee. At least annually, our management team (including the leaders of our Information Technology and Internal Audit teams) provides an update regarding our Program to the Board. This update provides an overall assessment of the effectiveness of our Program and a review of areas of focus for the upcoming year. The Board also receives periodic reports from our Vice President, Internal Audit, on the audit focus areas and control testing related to our information security systems and security controls, and our management team updates the Board, as necessary, regarding any material cybersecurity incidents.

companyName: AMPHENOL CORP /DE/

ticker: APH


text: Through its Audit Committee, the Board oversees the Company's ERM program, including risks arising from cybersecurity threats. The Audit Committee receives periodic presentations and reports on cybersecurity risks addressing recent developments, evolving standards, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee also receives information regarding cybersecurity incidents impacting the Company that are deemed more significant under the cybersecurity incident response plan, as well as ongoing updates regarding any such incidents until they have been addressed. The Audit Committee discusses the Company's approach to cybersecurity risk management with GATX senior management, including the CIO and the Global Head of IT Security.

companyName: GATX CORP

ticker: GATX


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of data privacy or security laws, litigation, and legal, financial and reputational risk.

companyName: Gentherm Inc

ticker: THRM


text: To help protect the Company from a major cybersecurity incident that could have a material impact on operations or the Company's financial results, the Company has implemented policies, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps the Company takes to reduce its vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include, but are not limited to: establishing information security policies and standards, implementing information protection processes and technologies, monitoring its information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices. The Company is currently in material compliance with applicable information privacy and cybersecurity standards.

companyName: CVS HEALTH Corp

ticker: CVS


text: Our operations are increasingly dependent on information technologies and services. Threats to information technology systems associated with cybersecurity risks and cyber incidents or attacks continue to grow, and include, among other things, storms and natural disasters, terrorist attacks, utility outages, theft, viruses, phishing, malware, design defects, human error, or complications encountered as existing systems are maintained, repaired, replaced, or upgraded. Risks associated with these threats include, among other things: • Theft or misappropriation of funds; • loss, corruption, or misappropriation of intellectual property, or other proprietary or confidential information (including customer, supplier, or employee data); • disruption or impairment of our and our customers' business operations and safety procedures; • damage to our reputation with our customers and the market; • exposure to litigation; • loss or damage to our worksite data delivery systems; and • increased costs to prevent, respond to or mitigate cybersecurity events.

companyName: Omnitek Engineering Corp

ticker: OMTK


text: The reports include information on any attacks or potential breaches within the Company as well as security events at third-party providers when the breach or potential breach may affect the Company. This process allows the Company to involve both senior management and third-party service providers, including forensic analysts, other cyber experts, and outside counsel, as necessary in order to combat potential threats and help ensure appropriate and timely responses to threats, and mitigation and remediation of any incidents.

companyName: CHEMED CORP

ticker: CHE


text: Role of the Board of Directors Our board of directors has overall responsibility for risk oversight and has delegated to the Audit Committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The Audit Committee receives quarterly updates on the enterprise risk management program, including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the Audit Committee, the full board of directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events would be brought to the attention of the full board of directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and board of directors informed and to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Liberty Broadband Corp

ticker: LBRDA


text: Our board of directors has designated the audit committee to oversee our exposure to risk, including risks related to cybersecurity threats, and the steps management has taken to monitor and control such risks. The audit committee receives periodic updates from our Vice President – Information Systems on our cybersecurity program and potential material cybersecurity threats. The audit committee is regularly informed about (1) the results of independent and objective assessments of key components of our cybersecurity program as reported by our internal audit department and (2) material risks that could impact our operations or financial condition and the measures implemented to adequately mitigate relevant risks. The audit committee regularly reports to our board of directors regarding its activities, including those related to cybersecurity risk oversight, and members of our board of directors periodically discuss cybersecurity matters with members of management.

companyName: Five Point Holdings, LLC

ticker: FPH


text: To augment our internal efforts, we engage third parties to conduct independent assessments of our cybersecurity posture. These external assessments provide an objective review of our security controls, breach readiness and compliance with industry standards and regulations. The insights gained from these audits inform refinements to our risk management strategies with respect to cybersecurity-related threats.

companyName: EVgo Inc.

ticker: EVGO


text: Our policies for Cybersecurity and the Safeguarding of Data, Computing Systems and Confidential Client Information policies establish the administrative, technical, physical safeguards and risk mitigations which are implemented to protect the security and confidentiality of all customer information as set forth by the federal regulatory authorities' interagency guidelines mandated by Section 501 of the Gramm-Leach-Bliley Act of 1999 and Part 364, Appendix B of the FDIC Rules and Regulations. Our objective is to emphasize compliance with all information and cybersecurity requirements, including those detailed in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, FFIEC guidance and regulatory agency guidelines which provide established standards for cybersecurity and the safeguarding customer information and Bank assets.

companyName: River Financial Corp

ticker: RVRF


text: The Company's senior management is primarily responsible for establishing policies and procedures designed to identify, assess and manage the Company's significant risks, with our Chief Information Security Officer (" CISO ") having primary responsibility with respect to material risks from cybersecurity threats. We also have a Corporate Enterprise Risk and Capital Committee, made up of members of senior management and the Company's Chief Risk Officer, which provides oversight of our enterprise-wide risk structure and of our processes to identify, measure, monitor and manage significant risks, including, but not limited to, cybersecurity risk.

companyName: LINCOLN NATIONAL CORP

ticker: LNC


text: Cybersecurity threats present a persistent and dynamic threat to our entire industry. The Company views cybersecurity risk as an enterprise-wide concern that involves people, processes and technology. The Company's Board, through its committees, referenced above in ITEM 1 "Business" - Enterprise Risk Management, has ultimate responsibility for risk oversight. In 2024, a Technology and Cyber Board Committee was established to further assist the Company Board's oversight responsibilities with respect to information technology governance, strategy, delivery and risk management, including cybersecurity and data privacy. Management is tasked with the day-to-day management of the Company's cybersecurity risks. The Company's Board has a practical understanding of information systems and technology use in our business operations and processes, as well as a recognition of the risk management aspects of cyber risks and cybersecurity. The RMC, which oversees controls for the Company's major risk exposures, has principal responsibility for oversight of cybersecurity risk. In addition, the Company's subsidiary boards of directors may provide additional oversight.

companyName: EVEREST REINSURANCE HOLDINGS INC


text: As part of our cybersecurity risk management program, we have adopted an incident response plan which provides for controls and procedures upon the occurrence of a cybersecurity event. In connection with that plan, we have established a cross-functional critical response team, comprised of members of management under the direction of our Chief Technology and Innovation Officer and Chief Administrative Officer and General Counsel, which is responsible for monitoring our cybersecurity incident response. In addition, this critical response team performs an impact assessment in the event of the occurrence of a cybersecurity event meeting certain criteria, which is elevated for the team's review and, if any such cybersecurity event is determined by the critical response team to have the potential to have a material impact on the Company, the cybersecurity event is elevated for further review and assessment by a senior management team, which includes all of the members of our standing crises control committee, and, under certain circumstances, the Audit Committee and/or the full Board of Directors.

companyName: Mid-America Apartments, L.P.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain a regularly tested incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, and handling it in accordance with that severity level. We have relationships with a number of third-party service providers to assist with cybersecurity containment and remediation efforts.

companyName: EyePoint, Inc.

ticker: EYPT


text: Our Information Security Program requires that employees adhere to our Third Party Information Security Policy, as well as the Third Party Risk Management Policy, which requires review of third-party controls to determine whether such controls meet the objectives of our Third Party Information Security Policy. The IRM team is responsible for seeing that appropriate information security risks are identified and monitored. We rely on many third-party service providers and network participants, including merchants, and, as such, a security breach or cyber attack affecting one of these third parties could impact us.

companyName: Discover Financial Services


text: As of December 31, 2024, no risks from cybersecurity threats or incidents have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.

companyName: APA Corp

ticker: APA


text: A material cyber security incident could materially affect our operations and production, including our ability to produce goods or provide services and our ability to timely and accurately produce financial reports. Further a cyber security incident could result in unauthorized access or disclosure of sensitive data, such as financial information, intellectual property, or customer, employee or supplier related data, including personally identifiable information. A material cyber incident could adversely affect our financial condition and results of operations, have as an adverse effect on our reputation and could result in legal actions against the Company. Please see the discussion under " Any unauthorized access to, disclosure, or theft of personal information we gather, store, or use could harm our reputation and subject us to claims or litigation." and "Third parties, our employees, or our vendors might gain unauthorized access to our network or seek to compromise our products and services" in Item 1A. Risk Factors for additional information.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: Responses to cyber-attacks are fast-moving and dynamic and would require an assessment of actual or potential damage performed by Registrant's cybersecurity team. If a cyber-attack were to occur, continuous engagement, communication and collaboration between Registrant's cybersecurity team and members of its CIRT as well as third parties would likely be necessary in order to gather accurate and complete information, perform a comprehensive evaluation and assessment of the cyber-attack, manage and contain the cybersecurity threat, and develop and execute a remediation and recovery plan. Members of its CIRT team would work together to determine whether a cybersecurity breach is material and required to be reported to the Board and publicly under applicable law.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: Management's Operations Committee meets quarterly and provides oversight and governance of the technology and cyber security programs. The Senior Vice President, Senior Technology Officer and Information Security Officer are members of this committee and report monthly on the technology and cyber security programs. The Senior Vice President, Senior Technology Officer also is a member of Management's Enterprise Risk & Disclosure Committee, which meets a minimum of four times a year, to report on the technology and cyber security programs.

companyName: HORIZON BANCORP INC /IN/

ticker: HBNC


text: We have certain processes for the identification, assessment, and mitigation of cybersecurity risks which are incorporated into our overall risk management processes in coordination with our information technology function. Such processes include physical, procedural and technical safeguards, and routine review of our policies and procedures to identify risks and improve our practices. We conduct cybersecurity training and testing for all of our employees covering timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, and mobile security, and we educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We engage third-party consultants to enhance our cybersecurity oversight and conduct penetration testing and vulnerability assessments. Further, we consider the cybersecurity practices of our third-party service providers, including through a general security assessment and contractual requirements, as appropriate, before engaging them in order to help protect us from any related vulnerabilities.

companyName: Werewolf Therapeutics, Inc.

ticker: HOWL


text: Helix's IT department keeps management involved and informed throughout the entire process of any cybersecurity incident from initial monitoring and discovery through the remediation and restoration, all in accordance with the processes outlined in our IRP. Initial notification regarding a cybersecurity incident may come through our third-party SOC or managed service providers, or from employees reporting internally to our IT helpdesk. Investigations are then performed to determine the appropriate actions per the IRP guidelines. Incidents that warrant further escalation are promptly shared with the CFO and continually updated, as appropriate, until remediation and restoration is achieved.

companyName: HELIX ENERGY SOLUTIONS GROUP INC

ticker: HLX


text: Because we are aware of the risks associated with third-party service providers, such as suppliers, software and cloud-based service providers, and cybersecurity partners, the Company implements processes to oversee and manage these risks. We assess the risks from cybersecurity threats that impact select suppliers and third-party service providers with whom we share personal identifying and confidential information. We require third parties to maintain security controls to protect our confidential information and data and notify us of breaches that may impact our data. Third parties that interact with our information or have access to our systems may have additional security requirements depending on the levels of risk. When new third-party risks are identified, we require those impacted to implement appropriate remediations or controls. Identified risks are documented and tracked along with general ongoing monitoring of third parties external risk posture. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third party service providers.

companyName: Cornerstone Building Brands, Inc.


text: Our Chief Information Officer has over 25 years of IT experience and has a thorough understanding of enterprise level cyber security framework. Our Chief Information Officer has also participated in cybersecurity reviews and implementations including various tools and platforms for over 10 years and drives strategic cyber security implementations based on industry best practices that helps us strengthen our security posture on a continuous basis.

companyName: Atara Biotherapeutics, Inc.

ticker: ATRA


text: External assessments have identified gaps and suggested enhancements that we consider when making changes to our cybersecurity risk management program.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: Management and Strategy recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property.

companyName: STREAMLINE HEALTH SOLUTIONS INC.


text: Additional information on the impact of cybersecurity threats applicable to our business can be found in the Risk Factors section of this report under the heading "Operational and Security Risks".

companyName: FISERV INC

ticker: FISV


text: Our management team is responsible for assessing and managing the material risks from cybersecurity threats and our Chief Financial Officer leads these efforts on behalf of the management team. Our management team members have expertise in information systems, compliance and corporate governance, which we believe are disciplines that are effective in the management of the Company's cybersecurity risk. Our Chief Financial Officer is well-informed on emerging cybersecurity risks and solutions used to mitigate and remediate loss due to cybersecurity incidents and is responsible for our internal cybersecurity programs and oversight of third-party cybersecurity vendors who monitor and execute on the prevention, detection, and mitigation of cybersecurity threats and incidents.

companyName: Fortress Biotech, Inc.

ticker: FBIO


text: Our Head of Information Security and Compliance and our InfoSec management team are primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Head of Information Security and Compliance has over two decades of experience leading cybersecurity, data privacy and risk management programs for large, multi-national organizations and Fortune 500 companies, and CISSP and CRISC certifications. Our InfoSec management team is comprised of qualified cybersecurity professionals whose collective expertise includes penetration testing, cyber threat intelligence, data privacy, information security, and risk and compliance in the healthcare, financial, and technology industries, with certifications such as CISA, CRISC, CISSP, CCSP, CIPP, GIAC, and OSCP.

companyName: AppLovin Corp

ticker: APP


text: installation of end point protection software on our Company-managed systems and workstations in an effort to detect and prevent malicious code from impacting our systems; a cross-functional team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents;

companyName: AMPHENOL CORP /DE/

ticker: APH


text: Since our formation, we have been primarily focused on research and development activities and pursuing FDA approval of our planned products.

companyName: Microbot Medical Inc.

ticker: MBOT


text: We have engaged consultants and other third parties in connection with our risk assessment processes. These third parties have assisted us with the design and implementation of our cybersecurity policies and procedures, as well as to monitor and test our safeguards.

companyName: Yext, Inc.

ticker: YEXT


text: We have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, cash flows, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: MARKETWISE, INC.

ticker: MKTW


text: Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cyber-security, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirements. In addition to its other responsibilities, the HSE & Technical Committee oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations.

companyName: UR-ENERGY INC

ticker: URG


text: The Board oversees our overall risk assessment process, where we assess key enterprise risks within the company, and at least quarterly, senior management reviews these risks with the Board. Cybersecurity and other technology risks, which are considered in our enterprise risk management framework, continue to remain a top priority for the Board. Primary oversight responsibility for cybersecurity and other technology risks has been given to the Audit Committee by the Board.

companyName: Torrid Holdings Inc.

ticker: CURV


text: The Company's Chief Information Security Officer (CISO), in coordination with Chief Information Officer, is responsible for leading the assessment and management of cybersecurity risks. The current CISO has over 25 years of experience in information security and is a Certified Information Systems Security Professional (CISSP). The CISO reports to the Board, the Audit Committee and management on cybersecurity risk assessment, policies, incident prevention, detection, mitigation, and remediation of cybersecurity incidents on a quarterly or as needed basis.

companyName: Veralto Corp

ticker: VLTO


text: As soon as the Board of Directors authorizes the creation of an audit committee comprised of our three independent non-executive directors, and adoption of an audit committee charter, the Audit Committee will be the governance body involved in, and ultimately responsible for, cybersecurity oversight. They will generally coordinate with our Chief Financial Officer in this regard. If needed, the full Board would be updated on cybersecurity risks and incidents. As of the date of this Annual Report, the members of the Board of Directors currently None of our directors on the Audit Committee nor our Chief Financial Officer have particular experience in cybersecurity matters. See "Item 10. Directors, Executive Officers and Corporate Governance – Committees of the Board of Directors."

companyName: Kun Peng International Ltd.

ticker: KPEA


text: Business Resilience We apply controls from best practices such as, but not limited to, The Business Continuity Institute (BCI), Disaster Recovery Institute International (DRII), and International Organization for Standardization (ISO) 22301 for developing and maintaining threat-agnostic plans with strategies to continue client services and critical business operations in the event of a disruption to critical dependencies. The business resilience planning process includes business impact analyses, risk assessments, and continuity strategies. Our business resilience team conducts regular exercises to validate and continuously improve the plans and strategies, including conducting tabletop exercises with teams from across the organization.

companyName: Paylocity Holding Corp

ticker: PCTY


text: Our Senior Director and Head of Information Technology and our management committee on cybersecurity, which includes Facilities, HR, IT, Legal, and Management, are primarily responsible to assess and manage our material risks from cybersecurity threats. Our cybersecurity team and IT management have years of cybersecurity experience and expertise including holding numerous applicable cybersecurity certifications, such as ISC2 Certified Information Systems Security Professional (CISSP).

companyName: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.

ticker: PACB


text: As part of planning for any suspected cybersecurity incident, the CIRT has developed certain incident response strategies to help collect and preserve forensic data, to mitigate the threat and to perform other activities to restore systems to normal operation. These strategies include many of the practices recommended by the United States Department of Homeland Security's Industrial Control Systems Computer Emergency Response Team. In addressing and resolving a significant cybersecurity incident, the Company may engage external experts in relevant fields, such as legal or forensic services, as needed. The Company also has a process whereby the Chief Information Officer (the "CIO") periodically meets with and assesses third-party service providers in order to help ensure the Company is made aware of any potential material cybersecurity threats or incidents in a timely manner. The Company's largest external service provider is CONA, as further discussed in "Item 1A. Risk Factors" of this report.

companyName: Coca-Cola Consolidated, Inc.

ticker: COKE


text: Cybersecurity is a complex and constantly evolving risk that we are committed to understanding and mitigating. The foundation of our information security practices is rooted in the principles set forth by the National Institute of Standards and Technology ("NIST"), ensuring a robust and comprehensive approach to safeguarding our digital assets. This program provides standards, guidelines, and best practices for improving our cybersecurity risk management. To effectively manage our cybersecurity risk, we employ a comprehensive approach encompassing risk assessment, identification, and mitigation, all aligned with the rigorous standards and principles. Cybersecurity and IT compliance risk metrics are monitored regularly to assess, identify, manage and protect our environment. Periodic audits of IT and Cybersecurity are carried out as part of internal and external audits, are performed by professionals and form a part of our overall risk management system and processes.

companyName: GREENLIGHT CAPITAL RE, LTD.

ticker: GLRE


text: Cybersecurity risk management is part of the Company's overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and facilitate coordination across different departments of our company. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. We engage with third party service providers to perform penetration tests and to inform us of possible vulnerabilities. In addition, cybersecurity training is provided to all employees on a regular basis but at least annually.

companyName: ThermoGenesis Holdings, Inc.

ticker: THMO


text: External experts supplement our internal expertise as necessary. Risks identified as significant risks are communicated to the Board of Directors, who ultimately oversees the program both directly and indirectly through Board Committees, such as the Audit Committee.

companyName: Cornerstone Building Brands, Inc.


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, (3) our cybersecurity operations center and third party service providers responsible for monitoring and measuring threats, and (4) our response to cybersecurity incidents;

companyName: Camping World Holdings, Inc.

ticker: CWH


text: Aviat's Board of Directors has oversight of the Company's cybersecurity risk as a component of its risk management. This includes prioritization of cybersecurity risks and the allocation of resources. The Board of Directors receives regular updates on the Company's cybersecurity program. The Board of Directors have delegated its responsibility for risk management oversight to the Audit Committee, which regularly reviews Aviat's cybersecurity program with the Company's management. The Company's management, including its Senior Director of Information Technology, CFO, and General Counsel, provide the Board of Directors updates regarding current and emerging cybersecurity threats, status of ongoing cybersecurity initiatives, certain incident reports and events, remediation efforts, and compliance with regulatory and industry standards.

companyName: AVIAT NETWORKS, INC.

ticker: AVNW


text: The cybersecurity team, led by our Director of SNM, is a collective of highly qualified individuals with diverse backgrounds in IT, security, cyber risk management, and digital forensics, and holding various professional certifications (such as CISA, GRCP, IPMP, IDPP, CEH, ISO 27001). Under the Director of SNM's leadership, our cybersecurity team continuously monitors for threats and implements necessary security controls, conducting regular reviews and updates to the cybersecurity strategy. Any potential or actual cybersecurity incidents are assessed for their financial impact by our Director of SNM and reported to our Chief Financial Officer for a comprehensive risk analysis.

companyName: Powerfleet, Inc.

ticker: AIOT


text: 1.Operational security: We leverage the industry standard CIA Triad Model in conjunction with comprehensive industry control frameworks, compliance regulations, privacy requirements and best practices, including: the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, PCI DSS, System and Organization Controls ("SOC") 1, SOC 2, GDPR, HIPAA, the Trans-Atlantic Data Privacy Framework and Cloud Security Alliance.

companyName: BLACKBAUD INC

ticker: BLKB


text: Role of Enterprise Risk Management Enterprise Risk Management (ERM) is a holistic process to identify, assess/measure, mitigate/control, and aggregate/escalate/report organizational risks, both internal and external, in order to make decisions aimed at maximizing shareholder value and achieving strategic goals. The overarching ERM program shapes information security strategy and development. ERM works with information security management to facilitate performance of Risk Assessments, the results of which are used to identify opportunities to strengthen the program.

companyName: FIRST BANCSHARES INC /MS/


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments of planned material changes in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Tenaya Therapeutics, Inc.

ticker: TNYA


text: Management of cybersecurity risk is the responsibility of the full Board of Directors, with additional assistance from the Audit Committee. The Board of Directors also devotes significant time and attention to the oversight of cybersecurity and information security risk and receives an operational risk update that includes a review of cybersecurity and information security risk. As part of its oversight of cybersecurity and informational security risk, on an annual basis, our Board of Directors reviews its Information Security Policy with its appointed Information Security Officer and frequently receives presentations on and discusses cybersecurity and information security risks, industry trends, and best practices from our Chief Information Officer and our Information Security Officer.

companyName: NORTHRIM BANCORP INC

ticker: NRIM


text: The Enterprise Risk Management Committee is a board-level committee focusing on enterprise risk, including cybersecurity risks. Multiple directors have decades of experience, not only in the banking sector, but also have been responsible for cybersecurity and technology departments at larger organizations. The Chief Security Officer is responsible for providing the Information Security strategy and operational planning for the overall Information Security program, and has decades of experience in the industry, advanced education degrees, and holds industry standard technical and security certifications. Several members of the Information Security team also hold multiple security certifications that tie directly to their job responsibilities. These certifications include, but are not limited to, ISC2 Certified Information Systems Security Professional (CISSP), ISACA Certified Information Systems Auditor (CISA), ISACA Certified Information Security Manager (CISM), EC-Council Certified Ethical Hacker (CEH), CompTIA Security+, CompTIA CySA+, CompTIA CASP+, and CompTIA PenTest+.

companyName: WESBANCO INC

ticker: WSBC


text: We have, from time to time, experienced threats to and breaches of our data and systems, including breaches of our data within third party vendor's system. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition as of December 31, 2023. For more information about the cybersecurity risks we face, see the risk factor entitled "Cybersecurity incidents, security breaches, loss of data and other disruptions could compromise sensitive information related to our business, prevent us from accessing critical information or expose us to liability, which could adversely affect our business and our reputation" in Part I, Item 1A of this report.

companyName: Ontrak, Inc.

ticker: OTRKQ


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures designed to protect the security, confidentiality, integrity, and availability of our business systems and information. We base our cybersecurity risk management program upon and measure it against the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0.

companyName: HOLOGIC INC

ticker: HOLX


text: Our company did not experience any cybersecurity incidents that materially impacted our operations for the year ended December 31, 2024. We remain unaware of any active threats that could significantly affect our business strategy or financial condition. For more information on cybersecurity risks, see "Risk Factors — Risks Related to Our Business and Industry."

companyName: Microvast Holdings, Inc.

ticker: MVST


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our General Administrative Leadership team, which consists of our CEO, CFO, COO, CPO, Vice President of Finance and Business, Vice President of Technology and our Head of Information Technology ("IT"), and is responsible for the strategic leadership of our cybersecurity risk management program. Our Head of IT, who also serves as our Information Security Officer, is responsible for the day-to-day management of our cybersecurity risk management program. The individual who is currently in this role has over thirty years of experience in information technology and cybersecurity risk management. Our Head of IT relies on both internal and external cybersecurity resources to manage and remain appraised of overall cybersecurity risks to our business and our industry.

companyName: Septerna, Inc.

ticker: SEPN


text: Our process to assess, identify and manage material risks from cybersecurity threats include potential threats associated with third-party service providers, including cloud-based platforms. On an annual basis, we review the SOC2 (or equivalent) attestation of controls for material third-party service providers, coupled with monitoring industry notices and threat intelligence regarding potential vulnerabilities or threats targeting these third-party services.

companyName: LIQUIDITY SERVICES INC

ticker: LQDT


text: The Company has a cybersecurity and incident response program designed to assess, identify, and manage material risks from cybersecurity threats, including matters related to the cybersecurity of the Company's critical infrastructure, data, or information technology systems and the Company's actions to prepare for, identify, assess, respond, mitigate and remediate material cyber, information security, or technology risks (collectively referred to as Information Security). This program includes: • operating a Cyber Security Operations Center; • raising employee awareness through annual general and job-specific cybersecurity trainings and employee phishing simulations; • maintaining defined cyber incident response plans; • enhancing security measures to protect our systems and data; • evolving monitoring capabilities to improve early detection and rapid response to potential cyber threats; and • adapting to new work environments that include off-site work through mitigation of remote network risk to our internal systems, assets, or data.

companyName: Vistra Corp.

ticker: VST


text: As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident disrupting business operations and compromising sensitive data. To manage cybersecurity risk, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. The cybersecurity strategy is memorialized within the Company's information security program. The program incorporates regulatory guidance and industry standards while leveraging information from industry associations, third-party benchmarking, audits, threat intelligence and peer industry groups. The information security program is reviewed by the Chief Risk Officer and presented to the Risk, Compliance and Planning Committee to periodically account for the changes in the cyber threat landscape. It is also periodically assessed by the Internal Audit department.

companyName: HANMI FINANCIAL CORP

ticker: HAFC


text: We recognize a cybersecurity incident experienced by a supplier or joint venture partner could materially impact us. We assess third-party cybersecurity controls as part of our third-party IT risk due diligence and engage in cybersecurity consultant-led solution design reviews when integrating new tools or third parties. We contractually require third parties to report cybersecurity incidents to us so we can assess the impact of the incident and any necessary regulatory reporting obligations that may be required.

companyName: GOODYEAR TIRE & RUBBER CO /OH/

ticker: GT


text: Our information services team is led by our Vice President-Information Services and Technology, who also chairs the Infosec Oversight Committee and has approximately 25 years of experience in the information technology industry. Collectively, the members of our Infosec Committee, Infosec Oversight Committee, and Executive Steering Committee have decades of experience within the information technology industry and/or cybersecurity areas. On a monthly basis, our Vice President-Information Services and Technology provides executive management with an Information Security Scorecard, which includes any cybersecurity events that have occurred. If a cybersecurity incident is declared under the IRP, we will evaluate whether such incident might have a material adverse impact on our business, financial condition, results of operations, or reputation, among other considerations, and communicate that discussion to executive management, who will then determine if escalation to the Board is warranted and if further disclosure is required to the SEC and/or other government agencies.

companyName: VALERO ENERGY CORP/TX

ticker: VLO


text: The Audit Committee oversees the Company's enterprise risk management program, which includes an annual assessment of cybersecurity risk. As a part of this assessment, the Audit Committee reviews and discusses the risks identified by management and the Company's policies and practices in place to mitigate those cybersecurity-related risks. Management presents to the Board of Directors on our cybersecurity strategy, results of testing and training and, as needed, to inform the Board of Directors and Audit Committee of any new or emerging threats or risks.

companyName: DYNEX CAPITAL INC

ticker: DX


text: Our cybersecurity risk management strategy relies on input from management, including the Chief Technology Officer, Chief Legal and Privacy Officer, and Chief Financial Officer, who report to the Chief Executive Officer, as well as the Chief Information Security Officer, to help us understand cybersecurity risks, establish priorities, determine the scope and details of our cybersecurity program and implement it. Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into our overall risk management strategy, and for communicating key priorities to employees. Our cybersecurity incident response and vulnerability management processes involve management, who participate in our disclosure controls and procedures.

companyName: Cardlytics, Inc.

ticker: CDLX


text: cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services, and broader enterprise IT environment; cybersecurity awareness training of our employees, incident response personnel, and senior management; a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents;

companyName: CREATIVE REALITIES, INC.

ticker: CREX


text: These processes are under continuous review and adjustment, with the committee meeting quarterly to evaluate and refine our cybersecurity practices.

companyName: Monogram Technologies Inc.

ticker: MGRM


text: The Senior Director - Information Security has over 15 years' experience in the information technology and cybersecurity field as well as over 15 years' experience in auditing information security, including previous roles in information security architecture, information technology and information security audit and governance. The Senior Director - Information Security has completed a CISO Academy Workshop, where he gained valuable insights to help improve our cybersecurity posture and program while also better aligning it to our overall business strategy and operating model. He received a BA in math and computer science from Ohio Wesleyan University and holds an Information Systems Auditor certification.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: The Audit Committee receives periodic updates from the CIO, the director of our cybersecurity team and a senior attorney, the three most senior leaders with responsibility for oversight of our key cybersecurity program components. These updates include matters such as ongoing changes in our external and internal cybersecurity threat landscape, new technology trends and regulatory developments, evolving internal policies and practices used to manage and mitigate cybersecurity and technology-related risks, and trends in various metrics that are used to help assess our overall cybersecurity program effectiveness. Our CIO also provides updates to the full Board of Directors on such topics at least annually.

companyName: DARDEN RESTAURANTS INC

ticker: DRI


text: 2024, the Cooperative did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Cooperative, including its business strategy, results of operations, or financial condition.

companyName: Golden Growers Cooperative

ticker: GGROU


text: Key elements of our cybersecurity risk management program include but are not limited to: authentication and authorization procedures, employee security awareness training, logging and monitoring procedures, network segmentation requirements, in transit and at rest encryption of certain data we deem sensitive, periodic vulnerability scanning, periodic control validation through penetration testing, periodic phishing attack simulations, production change control requirements, periodic tabletop exercises, and written incident response plans. We also use external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes.

companyName: Fluence Energy, Inc.

ticker: FLNC


text: Oceaneering continues to make cybersecurity a priority as the threat landscape evolves and becomes increasingly complex and sophisticated.

companyName: OCEANEERING INTERNATIONAL INC

ticker: OII


text: The Audit Committee is responsible for the Board of Directors' oversight of cybersecurity risks. The Audit Committee is composed of board members with diverse expertise including, cyber operations, risk management, technology and finance, equipping them to oversee cybersecurity risks effectively. The Audit Committee reviews our cybersecurity programs and the effectiveness of its risk management strategies. This review helps management identify areas for improvement and align our cybersecurity program with the overall risk management framework.

companyName: HUNTSMAN INTERNATIONAL LLC


text: The CCDC directly oversees information technology and information security risks through regular meetings, reports from management on information technology, cybersecurity, and related risk assessments, and incidents disclosed by third-party service providers as applicable. If a cybersecurity threat is identified, our Vice President of IT or other reporting individuals will immediately inform our IT service desk and notify our CIO and CPO. Once the threat has been analyzed, our CIO and CPO will inform our General Counsel of any security incidents. The General Counsel or her delegate will report on the incident, as appropriate, to the CCDC, our CEO, President, CFO, and to the Board, either at the next scheduled meeting or on a current basis, depending on the severity of the incident. Each quarter, the enterprise CPO presents legal and regulatory updates concerning cybersecurity, security incident response and notification, privacy, and artificial intelligence. A-Mark's CPO is certified by the International Association of Privacy Professionals as an EU, US, and management privacy professional, as well as an artificial intelligence governance professional. Our CPO has over a decade of privacy, data protection, and information management experience.

companyName: Gold.com, Inc.

ticker: GOLD


text: The Company has created and maintains processes that provide a playbook in the event of a cyber incident. These processes provide assessment and response tools designed to mitigate damage from attacks and integrate third-party digital forensics and legal providers and law enforcement in the Company's response plan. The Company also has instituted a variety of safeguards to counter ransomware threats.

companyName: EQC Liquidating Trust


text: We are further enhancing this control by implementing ACL's (access lists) in our CRM and ERP systems and any other mission critical platform.

companyName: SATIVUS TECH CORP.

ticker: SATT


text: Our cybersecurity team is responsible for assessing our cybersecurity risk management program and our incident response plan, which we regularly test through table-top exercises, and testing of our security protocols through additional techniques, such as penetration testing. In addition, we regularly engage independent third-party auditors to evaluate our compliance with various security compliance standards. We also conduct internal annual assessments of our cybersecurity risk management program. We review or update our cybersecurity policies, standards and procedures annually, or more frequently as needed, to account for changes in the threat landscape, as well as in response to legal and regulatory developments. Our cybersecurity efforts also include mandatory training for all employees and contractors on CrowdStrike's security and privacy policies. We also have a clearly defined acceptable use policy, and we require employees to certify to it. We also require employees to certify their adherence to our code of conduct. We also periodically send our employees simulated phishing emails to test their compliance with our policies. Although we have continued to invest in our diligence, onboarding, and monitoring capabilities over our critical third parties, including our third-party vendors and service providers, our control over the security posture of our critical third parties is limited, and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information assets owned or controlled by such third parties.

companyName: CrowdStrike Holdings, Inc.

ticker: CRWD


text: Also, in the event of a cybersecurity threat or cybersecurity incident, the Company's cybersecurity management team will investigate and perform impact analysis and, as necessary, the CTO will activate the Company's Cyber Incident Response Team. The Cyber Incident Response Team is a subset of the Company's Crisis Response Team, which has responsibility for operational and business resilience, as well as tactical and strategic response. A foundational aspect of the Crisis Response Team is prompt and comprehensive communications to all concerned parties, both internal and external, including direction for management to inform the Board about risks from cybersecurity threats.

companyName: UNITIL CORP

ticker: UTL


text: Our Vice President and Head of IT, who reports into the finance organization, has over 28 years of experience managing information technology and cybersecurity matters. He works collaboratively with outside consultants, including our Managed Services and Managed Security Services partners, to protect our information systems from cybersecurity threats and to promptly respond to cybersecurity incidents. He provides regular updates to the President and Chief Financial Officer regarding our efforts to monitor, prevent, detect, mitigate and remediate cybersecurity threats.

companyName: Neurogene Inc.

ticker: NGNE


text: Internal Audit: Our Internal Audit department performs audits, and our IT Risk and Compliance Team, which reports to the VP Security, monitors certain IT systems controls that are integrated into our larger internal control environment.

companyName: CELESTICA INC

ticker: CLS


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are present and similar to other financial institutions. The Corporation, as well as our customers, colleagues, regulators, service providers and other third parties, have seen an increase in information security and cybersecurity risk in recent years. We continue to assess the risks and threats in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity collaboration and capabilities.

companyName: CIVISTA BANCSHARES, INC.

ticker: CIVB


text: Our cybersecurity risk management framework for assessing, identifying, and managing material risks from cybersecurity threats is designed to protect the confidentiality, integrity, and availability of the information technology assets and data under our control.

companyName: Federal Home Loan Bank of Topeka


text: Third Party Service Providers The Bank has implemented a third-party management policy (Vendor Management Policy) within the Information Security and Cybersecurity Program which requires due diligence and consideration of cyber risk prior to contract signing. As deemed necessary, vendors identified within the program are reviewed at least annually, and in-depth reviews of critical vendors are documented and presented to management as needed. The overall program is presented to the Board of Directors each year.

companyName: Prime Meridian Holding Co

ticker: PMHG


text: Cybersecurity is integral to our overall risk management strategy, and an area of increasing focus for our Board and management. The Audit Committee, and where applicable, the entire Board, are involved in overseeing cybersecurity risks. They receive quarterly and bi-annual updates, respectively, from management on our cybersecurity threat risk management and strategy processes. These updates cover various cybersecurity topics, including data security posture, third-party assessment results, progress on risk mitigation goals, incident response plans, and material cybersecurity threat risks or incidents. The Board and Audit Committee also have discussions with our global head of Information Technology and engage in separate meetings to consider cybersecurity risks in the context of broader corporate matters.

companyName: ARTIVION, INC.

ticker: AORT


text: Our cybersecurity risk management program includes: physical, technological and administrative controls intended to support our cybersecurity and data governance framework, including controls designed to protect the confidentiality, integrity and availability of our key information systems and customer, employee, bank partner and other third -party information stored on those systems, such as access controls, encryption, data handling requirements and other cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices;

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: Third party vendors and suppliers also play a role in our cybersecurity risk management program. In circumstances where such third parties will access our systems and data, our SDIS participates in the vendor management process, including the review of contractual requirements and contractually imposing obligations on the vendor to report cybersecurity incidents to us so that we can assess the impact. In addition to the incident response plan and vendor management process, our cybersecurity risk management program includes: • an information technology and cybersecurity training program, and ongoing employee testing to evaluate the effectiveness of quarterly internal training and awareness communications; • external advisors to assist with cybersecurity risk assessment, including third-party monitoring of the Company's systems, external network penetration testing, and yearly cyber event preparedness exercises; • development of strategies to mitigate cyber risks; and, • crisis management, business continuity, and disaster recovery plans.

companyName: APOGEE ENTERPRISES, INC.

ticker: APOG


text: Our cybersecurity risk management program includes a Security Incident Response Plan ("SIRP"). Our SIRP provides the Company with the capability of planning, identifying, containing, and tracking cybersecurity incidents experienced by us or our third party service providers. Our SIRP was established to reduce or minimize the impact of cybersecurity incidents on our networks, IT systems, users or business processes. The execution of our SIRP is led by the Chief Information Officer ("CIO") in conjunction with our Security Incident Response Team, comprised of network, system administrators and cybersecurity experts, who, in the event of incident, together perform a damage assessment, deliver impact notifications and implement containment procedures depending upon the incident. In addition, we also engage third parties on an as needed basis to assess our cybersecurity practices and procedures.

companyName: Utz Brands, Inc.

ticker: UTZ


text: The Company provides training, support and alerts for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: NOBILITY HOMES INC

ticker: NOBH


text: Our Chief Technology Officer ("CTO") is responsible for the development and implementation of our information security program on a Company-wide basis, together with a dedicated team of experienced, Company-wide information security analysts. Our CTO has over twenty years of experience leading the development, implementation, and oversight of information security programs. Other members of our information security team are generally seasoned professionals with broad cybersecurity experience and expertise, including with respect to cybersecurity threat assessment and detection, mitigation technologies, incident response, and training on such topics.

companyName: Angi Inc.

ticker: ANGI


text: A HITRUST assessment address the need for a continuously relevant cybersecurity assessment that incorporates best practices and leverages the latest threat intelligence to maintain applicability with information security risks and emerging cyber threats, such as ransomware and phishing. HITRUST assessments also provide a level of assurance that delivers full transparency, accuracy, consistency, and integrity.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: Part I | Item 1C. Cybersecurity Regular independent third-party assessments, penetration testing, and internal audits are conducted to validate controls and to position our cybersecurity maturity level at or ahead of industry trends in meeting stringent security standards. We regularly assess our security program internally and externally, through benchmarking studies and assessments against our Information Security and Privacy Policies and Standards and conduct assessments of the effectiveness of relevant internal control activities designed to restrict inappropriate access to our IT systems, support data integrity within our IT systems, and ensure ongoing availability of our IT systems. Certain of these control activities are also subject to an assessment by our external auditor to support its opinion on the effectiveness of our internal control over financial reporting.

companyName: Jackson Financial Inc.

ticker: JXN


text: (i) the Executive Committee, which consists of, among others, the CEO, Chief Financial Officer, Chief Legal Officer and Chief Compliance and Privacy Officer, and (ii) the Audit Committee. The Cybersecurity and Risk Management Team is responsible for maintaining and carrying out the Cybersecurity Risk Management Program.

companyName: Bausch & Lomb Corp

ticker: BLCO


text: Our executive team evaluates our cybersecurity risk and reports any findings, recommendations, or material impacts to the Board of Directors, which provides an oversight function. The Board of Directors has charged management with the responsibility for oversight of cybersecurity risks and incidents and any other risks and incidents relevant to the Company's computerized information system controls and security.

companyName: INVO Fertility, Inc.

ticker: IVF


text: At this time, we are not aware of any risks from cybersecurity threats, including as a result of any previous cyber security incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our efforts to prevent and detect cybersecurity threats and incidents, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K for additional discussion about cybersecurity-related risks.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition While Peabody has experienced cybersecurity incidents in the past, to date none have materially affected the Company's business strategy, results of operations or financial condition. Peabody continues to invest in the cybersecurity and resiliency of its networks and to enhance its internal controls and processes, which are designed to help protect its systems and infrastructure, and the information they contain.

companyName: PEABODY ENERGY CORP

ticker: BTU


text: Farmer Mac's CISO manages Farmer Mac's cybersecurity program, which aligns to industry standards and is reviewed by the cybersecurity subcommittee and approved by the board enterprise risk committee annually, and which includes the identification, evaluation, and prioritization of security risks, as well as the company's response to security incidents. The CISO has more than 20 years of experience in cybersecurity and information technology and holds a Master's degree in Business Administration with a focus on Information Technology. The CISO also holds a Certified Information Security Manager (CISM) certification, which is an advanced certification indicating that an individual possesses the knowledge and experience required to develop and manage an enterprise information security program. The CISO reports to Farmer Mac's Senior Vice President – Enterprise Risk Officer, who in turn reports to the Chief Executive Officer.

companyName: FEDERAL AGRICULTURAL MORTGAGE CORP

ticker: AGM


text: We also have a policy for responding to and mitigating cybersecurity incidents. Our incident response procedures were overseen until recently by our Chief Information Officer ("CIO"). In connection with the upcoming retirement of our CIO, we recently hired a new Chief Information & Technology Officer ("CITO") who oversees our incident response procedures. Our incident response procedures are reviewed and updated periodically.

companyName: UNIFIRST CORP

ticker: UNF


text: To date, we do not believe there have been risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Pinnacle West or APS. However, there is no assurance that will continue to be the case. If a significant cybersecurity event or incident were to occur, our ability to fulfill our critical business functions and our business strategy, results of operations, and financial condition could all be materially impacted. See the risk factor entitled, "We are subject to cybersecurity risks and risks of unauthorized access to our systems that could adversely affect our business and financial condition" in Item 1A—Risk Factors for more information.

companyName: ARIZONA PUBLIC SERVICE CO


text: The Audit Committee reports to the full Board annually regarding cybersecurity. The full Board also receives annual briefings from external experts on cybersecurity as part of the Board's continuing education on topics that impact public companies.

companyName: DIH HOLDING US, INC.


text: In the event of a cybersecurity incident, we intend to follow the steps outlined in our incident response plan, including notifying our senior management, as appropriate.

companyName: W. P. Carey Inc.

ticker: WPC


text: We have developed an enterprise risk management program designed to monitor and assess risks arising from our business operations and make informed decisions about how to manage risk. The enterprise risk management program is overseen by our audit and risk committee and is implemented under the leadership of our vice-president of risk and compliance, who reports to our general counsel and has a direct line of communication to the chair of our audit and risk committee. As part of our enterprise risk management program, we identify and review risks related to cybersecurity on a regular basis, including risks related to third-party access to our information technology systems, and we prioritize risk categories to inform enterprise risk assessment reporting. We conduct periodic enterprise risk assessments and report the results to the executive team and the audit and risk committee.

companyName: COMPASS Pathways plc

ticker: CMPS


text: We employ a comprehensive set of processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. These processes include: • Continuous monitoring of network traffic and information technology systems for signs of potential threats; • Regular vulnerability assessments and penetration testing to identify and address weaknesses; • Implementation of cybersecurity measures, such as firewalls, intrusion detection systems, and data encryption; • Employee training and awareness programs to educate all staff about cybersecurity risks and prevention measures; and • Incident response plans to ensure swift, effective, and adequate disclosure of cybersecurity incidents to the appropriate individuals within the Company.

companyName: NEOGEN CORP

ticker: NEOG


text: The Company's Board of Directors oversees cybersecurity risks consistent with its general risk oversight responsibility. The Audit Committee of the Board has specific responsibility for reviewing the status of the security of the Company's electronic data processing information systems and the general security, including cybersecurity, of the Company's people, assets and information systems. In support of this general oversight, the full Board reviews at least annually the most significant enterprise risks facing the Company, including cybersecurity risks, as identified in the Company's Enterprise Risk Management program. This review, which includes key members of senior management, covers any key risks from information security that have been identified and corresponding action plans. The Audit Committee also receives regular updates from the Company's CIO and CISO about the Company's information security and systems security programs and plans, including emerging trends and progress on overall enterprise cybersecurity programs and priorities. These updates occur at least three times a year, with interim updates as needed.

companyName: PROCTER & GAMBLE Co

ticker: PG


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • an external security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers.

companyName: HilleVax, Inc.


text: Information Security Policies and Procedures We manage our cybersecurity risk in accordance with our Information Security Program (the "Information Security Program"), which is applicable to all users of our information technology assets, information assets, and facilities, including our employees, contractors, vendors, volunteers, and agents. The Information Security Program includes an Information Security Incident Response Policy (the "Incident Response Policy"), which sets forth the rules and requirements for identifying, investigating, validating, prioritizing, and responding to information security incidents, and addresses the response portion of security monitoring. The Information Security Program also includes: (i) an Information Security Incident Response Procedure (the "Incident Response Procedure"), which delineates the processes for reporting, classifying, investigating, planning, containing, eradicating, recovering, documenting, and communicating information security incidents, as well as post-incident activities, and (ii) a Security Monitoring Policy, which establishes the rules and requirements for enabling, logging, alerting, and monitoring real time security alerts and security logs (automated or manual), as well as various condition monitoring tests and reviews, and documentation requirements in connection with security incident identification.

companyName: FIVE STAR BANCORP

ticker: FSBC


text: Cybersecurity risk management is integrated into the Company's enterprise-wide risk management. Our Board has overall oversight responsibility for our risk management and management is responsible for identifying, considering, and assessing material risks to the Company.

companyName: NIOCORP DEVELOPMENTS LTD

ticker: NB


text: Our cybersecurity risk management program includes: • risk assessments and rating platforms that are leveraged to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents through monitoring and identification activities; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • annual cybersecurity awareness training for employees and web and mobile developers, including responsible information security, data security and cybersecurity practices; • a computer incident response team ("CIRT") that leverage our cybersecurity incident response plan which includes procedures for responding to cybersecurity incidents, escalating notifications, and reporting requirements to regulatory bodies; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Frontier Group Holdings, Inc.

ticker: ULCC


text: We have implemented security measures and will continue to devote resources to address security vulnerabilities in an effort to prevent cyberattacks. All employees receive cybersecurity training and other education regarding their use of computers, information technology, and sensitive data.

companyName: ARTESIAN RESOURCES CORP

ticker: ARTNA


text: Cybersecurity Risk Management and Strategy AerSale has developed and implemented a comprehensive cybersecurity risk management program for identifying, assessing, and managing material risks to protect the confidentiality, integrity and availability of critical systems and information relevant to our business. Our program utilizes a risk-based approach and is designed based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST"), and the Center for Internet Security ("CIS"), and shares common methodologies, reporting channels, and governance processes that apply across all areas of our enterprise risk management, including legal, compliance, operational, and financial risks.

companyName: AerSale Corp

ticker: ASLE