text: OAS, risk management oversight is further managed through our Head of Information Security, who is responsible for overseeing the information security aspects of our cybersecurity framework. Our Head of Information Security brings extensive expertise to the role, with military experience in information security, a B.Sc. in Information Systems Engineering, and specialized training in computer and information systems security/information assurance from the T V S D Academy. Additionally, our Head of Information Security is certified by the Standards Institution of Israel as a Senior Internal Auditor for ISO 27001. Her areas of expertise include performing risk assessments, developing business continuity plans, drafting information security policies and procedures, conducting internal audits, leading information security training, and evaluating information systems structured approach ensures that our cybersecurity governance remains robust, proactive, and aligned with industry best practices.

companyName: Ondas Inc.

ticker: ONDS


text: Mapping data flows and user locations: We understand where user data is stored and transmitted, enabling us to identify relevant privacy laws and to implement suitable user data protection.

companyName: Mega Matrix Corp.

secItem: Item 1C


text: The Sustainability and Risk Committee of the Board has been delegated oversight responsibility of Vistra's Information Security. Vistra periodically engages third-party advisors to provide cybersecurity oversight and tabletop training to the full Board to further our commitment to responsible oversight of cybersecurity risk management. At least quarterly, our CIO reports to the Board on our Information Security program, including cybersecurity risks and threats (including the emerging threat landscape), an assessment of our Information Security program, and the status of projects to strengthen our Information Security program. In furtherance of our commitment to responsible oversight of cybersecurity risk management, in 2023, the Board appointed a director who brings extensive cybersecurity expertise to the Board.

companyName: Vistra Corp.

ticker: VST


text: We have implemented incident response and breach management processes, which have four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) detection and analysis of a security incident, 3) containment, eradication and recovery, and 4) post-incident analysis. Such incident responses are overseen by leaders from our IT and accounting teams.

companyName: TEJON RANCH CO

ticker: TRC


text: Our CISO executes the Cybersecurity Program with the support of the Cybersecurity Management Team, which has extensive cybersecurity expertise to protect and defend our networks, physical systems, infrastructure, and data from cybersecurity risks. Our CISO has 30 years of experience in cybersecurity, IT networking and electronic security, and holds a degree in Information Systems (Cybersecurity concentration). He has specific experience in the following cybersecurity areas: global IT security policy & governance; information risk management; cybersecurity strategic planning and integration; enterprise infrastructure cybersecurity engineering; incident response and remediation; global supply chain cyber risk management; cybersecurity awareness training; M&A cyber risk management; Cloud security; identity management; disaster recovery; and cybersecurity damage assessment.

companyName: HUNTINGTON INGALLS INDUSTRIES, INC.

ticker: HII


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risks are considered a part of our overall business strategy, financial planning, and capital allocation.

companyName: Freshworks Inc.

ticker: FRSH


text: Monitoring Cybersecurity Incidents The Corporation's efforts to prevent and detect cybersecurity incidents include continuous monitoring of the Corporation's networks. Employees throughout the Corporation are trained to report cybersecurity threats as they are identified. If an incident occurs or is suspected, it is reported to the DPM who completes an initial assessment of the incident and assigns a priority level, as outlined in the IRP, to the incident. Simultaneously, the DPM initiates the review process with CMAT and proceeds with the remediation process for recovery and eradication.

companyName: AMPCO PITTSBURGH CORP

ticker: AP


text: Our CISO is a standing member of our Enterprise Risk Council, which seeks to strengthen our company's processes with respect to the identification, assessment, management and monitoring the risks most likely to impact our strategic success, including cybersecurity risk. The council is chaired by our VP, Internal Audit, and its members are employees drawn from various areas of our organization. The council meets at least quarterly or more often as needed, to further strengthen risk management activities across the Company, including the risk of cybersecurity incidents.

companyName: Sylvamo Corp

ticker: SLVM


text: The Company maintains a robust enterprise-wide information security program aimed at assessing, identifying, and effectively managing cybersecurity risks, threats, and incidents. The Company has integrated cybersecurity risk management into its broader risk management framework to promote cybersecurity risk management company-wide.

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: Our management team, including our Chief Legal Officer, Chief Financial Officer and IT Senior Director, has over a combined 50 years of risk management experience, including our IT Senior Director who has over 15 years of experience overseeing cybersecurity and risk management. This team is responsible for assessing and managing our material risks from cybersecurity threats, and has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes experience running cybersecurity programs at similarly situated commercial biotechnology organizations and navigating the associated risk landscape.

companyName: ARDELYX, INC.

ticker: ARDX


text: The CISO assesses cyber risk and provides recommendations for management decision(s) by the ORC on a routine basis. The CISO briefs the Audit Committee on a quarterly basis. These updates include compliance measures designed to meet applicable regulations as well as current or planned changes to the regulations, an overview of the current cyber threats, risk management activities, and discussions of cyber incident investigations that warrant the attention of the Board. The CISO also provides an annual update to the entire Board of Directors on topics such as changes in cybersecurity, top threats facing the Company, key risks and mitigation efforts, and any potential material cybersecurity incidents. The Chair of the Audit Committee also provides a quarterly report to the Board on any information security topics presented to the Audit Committee by management.

companyName: GLOBE LIFE INC.

ticker: GL


text: Management's Role in Cybersecurity Risk Management The Company's management and the CISO of the Adviser manage the Company's cybersecurity program. The CCO of the Company oversees the Company's compliance program and relies on the Adviser's CISO to assist with assessing and managing material risks from cybersecurity threats. The Adviser's CISO has 15 years of experience in actively managing cybersecurity and information security programs for financial services companies with complex information systems.

companyName: Barings BDC, Inc.

ticker: BBDC


text: Avalo's management and Board of Directors recognize the importance of information security and managing cybersecurity risks across the enterprise. We have strategically designed our robust Information Security Program (the "Program") to assess, identify, and manage these cybersecurity risks, protect the Company from such risks, and respond to, and recover from, cybersecurity incidents.

companyName: Avalo Therapeutics, Inc.

ticker: AVTX


text: In response to an identified cybersecurity incident, or as it deems appropriate, the CSIRT Steering Committee will assemble and oversee a CSIRT, comprised of appropriate personnel and subject matter experts depending on the scope and severity of the incident, relevant or impacted business units and entities, and type of information or systems potentially compromised by the cybersecurity incident. When assembled, the CSIRT is responsible for developing and implementing an overall response strategy to contain, control, and remediate the cybersecurity incident, including securing our affected systems and/or information, mitigating harmful effects of the incident, preventing further compromises, and communicating information to affected parties, regulatory agencies and law enforcement, as necessary. The CSIRT may seek assistance from or engage external support providers including legal counsel, outside technology or forensic experts, investigation service providers, and others, as appropriate, to assist in the response to the incident, based on its nature and scope. Pursuant to the Plan and at the direction of the CAO, the Enterprise Security Director will conduct a post-incident remediation analysis and report findings to the CSIRT Steering Committee. The Plan is tested and reviewed at least annually.

companyName: WEC ENERGY GROUP, INC.

ticker: WEC


text: The Company maintains a cyber risk program as a part of its enterprise risk management program that is designed to identify, assess, mitigate and manage cyber risks. The Company's Vice President of Information Technology is responsible for managing the Company's cyber risk program, informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising third parties assisting in these efforts. The Company's Vice President of Information Technology has two decades of experience in the Information Technology industry, with a strong emphasis on cybersecurity whose professional experience is distinguished by a Bachelor's degree in Network Operation and

companyName: Gaming & Leisure Properties, Inc.

ticker: GLPI


text: As of the date of this Annual Report on Form 10-K, the Company does not believe it has encountered, and has not identified any risks from cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. See "Item 1A, Risk Factors," for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: AVIAT NETWORKS, INC.

ticker: AVNW


text: Medpace assesses and evaluates cybersecurity risk using the framework established by the National Institute of Standards and Technology (NIST). Bi-annually, at meetings of the Board of Directors, utilizing the NIST framework standards as a guide, the Information Technology Team discusses the Company's cybersecurity mitigation and resolution maturity and readiness. The Information Technology team's reports to the Board also include reviews and evaluations of key cybersecurity risk focus areas and initiatives, as well as quantitative incident occurrence information.

companyName: Medpace Holdings, Inc.

ticker: MEDP


text: On a periodic basis, but not less than annually, the ISO in conjunction with the Compliance/ERM Team, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Company's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The Compliance/ERM Team reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.

companyName: CFSB Bancorp, Inc. /MA/

ticker: CFSB


text: The Head of Technology Risk has extensive experience in cybersecurity and technology and is responsible for all aspects of cybersecurity across Sixth Street. He has a B.S in Computer Science from University of Washington and has over 18 years of experience contributing to cybersecurity related workflows, processes, policies, system designs, program management, and vulnerability discovery, exploitation, mitigation, and remediation.

companyName: Sixth Street Lending Partners


text: Our Board of Director's Enterprise Risk Management Committee (the "ERMC") is responsible for the oversight of risks from cybersecurity threats. At least annually, the ERMC receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as anticipated emerging threats, cybersecurity posture, progress towards predetermined risk-mitigation-related goals, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the ERMC generally receives materials including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and discusses such matters with our Chief Information Security Officer, Chief Information Officer, and Chief Privacy and Information Risk Officer. Members of the ERMC are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: Our CIO has served in various executive leadership roles for over 10 years and has over 30 years of experience in technology. Prior to joining YETI, he was the Senior Vice President of Consumer Technologies at a large publicly traded cosmetics company. The CIO holds a Masters of Business Administration. Our Director, Cyber Security has served in various roles in information technology and information security for over 25 years. Prior to joining YETI, he was a principal information security engineer for a global information technology consulting company. Our Director, Cyber Security holds an undergraduate degree in information technology, a master's degree in information systems and technology management and has attained the professional certifications of Certified Information Systems Security Professional and Certified Information Systems Auditor. Our Director, Technology Compliance has served in various roles in information technology for 12 years, including as a compliance manager for a large software company and information technology consultant for a major consulting firm. Our Director, Technology Compliance holds an undergraduate degree in accounting and a master's degree in management information systems and has attained the professional certifications of Certified Information Systems Auditor. Our Chief Legal Officer has over 14 years of experience managing risks, including risks arising from cybersecurity threats, in an officer capacity. Our Chief Financial Officer has 20 years of experience managing risks at large companies.

companyName: YETI Holdings, Inc.

ticker: YETI


text: We monitor our environment for cybersecurity threats with real-time ability to activate measures to minimize impact, respond to incidents, and investigate issues. We routinely conduct security assessments of our applications, manage vulnerabilities, and perform penetration testing as well as exercises that mimic cybersecurity incidents to evaluate and enhance our security posture and lower cybersecurity risk. In addition to our own systems and technology, we rely on third-party service providers for certain software, technology and cloud-based systems and services that support a variety of critical business operations. We have policies and processes designed to identify, assess and manage cybersecurity risk relating to these third-party service providers. When contracting with these providers, the procurement function works closely with the compliance and legal teams to conduct diligence and help appropriately manage risk, including cybersecurity risk, throughout the life cycle of the contract. We have developed, and seek to incorporate, standard contractual security requirements into our service provider agreements. We also perform cybersecurity assessments of third-party service providers where we deem appropriate given the nature of the engagement and the data and systems expected to be accessed.

companyName: OSI SYSTEMS INC

ticker: OSIS


text: Role of the Board The Board has delegated to the Audit Committee primary responsibility for overseeing enterprise risk management, including oversight of risks from cybersecurity threats. The Audit Committee periodically reviews TPL's policies and practices, including incident response plans, for managing cybersecurity risks to ensure that such policies and practices are appropriately tailored to our risk framework. Throughout the year, the Audit Committee receives quarterly IT and cybersecurity updates unless there is a notable event that requires immediate communication. These quarterly updates include cybersecurity risk assessment updates from our Director of Information Technology, including key risk indicators, the steps management has taken to monitor and control such cybersecurity risk exposure, and continuous improvement efforts. In addition to the risk management experience of the Audit Committee members, Barbara J. Duganier, a member of the Audit Committee, holds the CERT Cybersecurity Oversight Certification from Carnegie Mellon University.

companyName: Texas Pacific Land Corp

ticker: TPL


text: While we have experienced cybersecurity incidents in the past, to date, none have materially affected the Company or our financial position, results of operations, or cash flows. We continue to invest in the cybersecurity and resiliency of our systems and networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "If our information technology systems, data, or physical facilities, or those of third parties upon which we rely, are or were compromised, we could experience adverse business consequences resulting from such compromise," which should be read in conjunction with the information contained within Item 1C, Cybersecurity.

companyName: IonQ, Inc.

ticker: IONQ


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are based on frameworks established by the International Organization for Standardization, specifically ISO/IEC 27001:2013 and other applicable industry standards. We have established comprehensive Information Security Management Systems ("ISMS") policies, which are independently reviewed and audited annually for conformity and effectiveness under ISO/IEC 27001. Our cybersecurity program in particular focuses on the following key areas: Collaboration

companyName: authID Inc.

ticker: AUID


text: The Audit Committee regularly reports to the Board regarding the Audit Committee's oversight of cybersecurity matters, such as the periodic assessment and testing of the Company's policies, standards, processes and practices and the risks identified in such assessment and testing.

companyName: Vishay Precision Group, Inc.

ticker: VPG


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "We rely heavily on technology to operate our business and cybersecurity threats or other disruptions to our technology infrastructure could harm our business or reputation" in Item 1A. Risk Factors.

companyName: SAIA INC

ticker: SAIA


text: Finally, the ISMS incorporates an Incident Response Plan, which outlines the procedures that we use to investigate and respond to cybersecurity events and alerts, an Incident Response Policy, which sets out high-level principles and requirements that apply to cybersecurity incident response, and a Business Continuity Plan, which sets out high-level steps in protecting the services, assets and employees of the Company during an event that disrupts business continuity. The Incident Response Plan includes clearly defined roles and responsibilities, including guidance for reporting up the chain to senior management and, where appropriate, to the Audit Committee and the Board. It comprises four high-level phases: identification and investigation of a cybersecurity incident (including suspected personal data breaches); containment to lessen any ongoing harm; eradication of the root cause; and, post-recovery, supplementation of the cybersecurity incident record with lessons learned in order to improve our incident response capabilities. The Business Continuity Plan defines the procedures to be followed if there is a critical failure that results in operations at one of our corporate offices being suspended, as well as the procedures to be followed if there is a critical failure of our services or underlying hosting infrastructure that results in significant degradation of a service provided, with an aim to operate at existing service levels throughout the duration of the incident.

companyName: Bumble Inc.

ticker: BMBL


text: To assist with its information security programs, the Company engages with multiple third-party providers and specialists, including firms with personnel credentialed by internationally recognized organizations such as ISC2, the SANS Institute, and ISACA. Services provided include but are not limited to network evaluations, configuration and vulnerability assessments, penetration testing, and business continuity planning, the results of which are shared with management along with any remediation plans. In addition, an annual information systems and security audit is conducted by the Company's internal audit provider with results reported to the Audit Committee of the Board. Information security matters also fall within the scope of periodic examinations by the Bank's primary regulator, the Office of the Comptroller of the Currency (OCC).

companyName: First Bancorp, Inc /ME/

ticker: FNLC


text: The Committee is responsible for escalating key risks members of Executive Management not serving on the committee as well the Board annual audit over cybersecurity related activities is completed by an independent third party.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: Our CSO, who reports directly to our CTO, works closely with our CIO who reports directly to our Chief Executive Officer. Over the past two decades, our CIO has held various positions in information technology and information security, including as CIO in two public companies, managing and controlling cybersecurity long-term programs and risks. Both our CTO, who is a co-founder of JFrog and is also a member of our Board, and our CSO have extensive experience assessing and managing cybersecurity programs and cybersecurity risks, and they work closely to define the initiatives of our cybersecurity program, the CSO organization structure and cyber business continuity plan planning. Our CTO is updated regularly on the status of our cybersecurity program. This allows us to address emerging threats and make informed decisions in real-time and to protect our systems on a timely basis.

companyName: JFrog Ltd

ticker: FROG


text: Superior employs a risk-based vulnerability management process for assessing and managing cybersecurity risk. Utilizing the National Institute of Standards and Technology ("NIST") cybersecurity framework, the IT team assesses the risk based on the Center for Internet Security Critical Security Controls. The assessment includes the ability to identify, protect, detect, respond and recover from cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers. The risk-based vulnerability management prioritizes action under both an asset context and vulnerability context, considering factors such as asset exposure, potential business impact, threat context and vulnerability severity.

companyName: SUPERIOR INDUSTRIES INTERNATIONAL INC

ticker: SSUP


text: We are committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats.

companyName: Liberty Broadband Corp

ticker: LBRDA


text: The security of the Company's products, services and corporate network is a key priority both for the growth of the Company's business and its responsibilities as the leading financial guaranty insurance company. The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations. As described above in Cybersecurity – Risk Management and Strategy, the Company's Chief Technology Officer has management responsibility for overseeing a process designed to remediate cybersecurity risks, and reports to the Board, Risk Oversight Committee, Audit Committee and management at least semi-annually. The Chief Technology Officer reported to the Board, Risk Oversight Committee and Audit Committee four times in 2024. The Chief Technology Officer has over 25 years of experience in information technology, technology research and security and operations management, with over 15 of those years focused in financial services and insurance. The Chief Technology Officer holds a Master of Science in Information Systems and a Master of Business Administration with a focus in Management and Operations. The Company has appointed a Chief Information Security Officer, who is responsible for leading the assessment and management of cybersecurity risk. In 2024, the Chief Information Security Officer made an annual report on information technology and cybersecurity risks to the Board and made four quarterly reports to the Risk Oversight Committee and the Audit Committee. The Chief Information Security Officer has over 25 years of experience in information security and is a Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Certified Information Systems Auditor (CISA). The Chief Information Security Officer reports to the Board, its committees, and management on cybersecurity threats on a regular basis.

companyName: ASSURED GUARANTY LTD

ticker: AGO


text: We experience cyber-attacks of varying degrees on a regular basis in the ordinary course of our business. As of the date of this report and for the time period of January 1, 2024, through December 31, 2024, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, there can be no assurance that we will not be materially affected by such risks in the future. For information on the cybersecurity threats and risks we face and the potential impacts on the business related thereto, see Item 1A. Risk Factors – Risks Related to Security Vulnerabilities and Service Reliability.

companyName: LIVEPERSON INC

ticker: LPSN


text: Peoples' Chief Risk Officer ("CRO") reports to the Risk Committee and the CEO and has primary responsibility for the design and implementation of the ERM Program. The ERM Program establishes Peoples' risk appetite, monitors key risk and performance indicators, identifies key risks within the firm, designs and executes specific risk initiatives and monitors risk mitigation efforts and control processes. The CRO updates the Risk Committee quarterly on the overall risk condition of Peoples inclusive of any cybersecurity issues or threats.

companyName: PEOPLES BANCORP INC

ticker: PEBO


text: The Company employs a robust system of information technology and cybersecurity controls across its enterprise to assess, identify, and manage material risks from cybersecurity threats. This framework is implemented and overseen by management's information security and compliance department, which is led by the Company's Vice President, IT Security & Compliance. The Vice President, IT Security & Compliance, who reports directly to Senior Vice President, Information Technology, has a Bachelor of Science in Commerce, with concentrations in management information systems and marketing, and has over 30 years' experience in all aspects of IT, including managing development, operations, cybersecurity, and other key areas. The Senior Vice President, Information Technology, has an Executive Technology Leadership Certificate in IT from Cornell University and has over 25 years of IT experience leading large-scale initiatives to enhance infrastructure and architecture based on emerging technologies and strategies. The Vice President, IT Security & Compliance and Senior Vice President, Information Technology, provide regular briefings to our senior management team on cybersecurity matters, including threats, events, and program enhancements. The Company also has a network of regional information technology directors stationed in each region where our resorts are located, who are integrated into the overall enterprise information technology security and compliance program. The Company references a recognized third-party cybersecurity framework to evaluate and manage cyber risk within the Company. We regularly benchmark against this framework and use the findings to develop and fine tune our cybersecurity roadmap for ongoing evolution and improvement.

companyName: Playa Hotels & Resorts N.V.


text: The Program integrates seamlessly with the company's enterprise risk management program. Continuous threat and vulnerability assessments inform system and control updates, effectively mitigating risks. Layered security controls work together to protect customer information and transactions. Additionally, third-party experts conduct periodic program evaluations through penetration testing, audits, and best practice consultations, with results driving program improvement initiatives. As a regulated entity, Bank of Southern California undergoes regular bank regulatory examinations evaluating the information security program and its compliance with federal regulations.

companyName: California BanCorp \ CA

ticker: BCAL


text: General procedures designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; and An outsourced IT security team to assist with managing (1) our cybersecurity procedures, (2) our security controls, and (3) our response to cybersecurity interests.

companyName: INVO Fertility, Inc.

ticker: IVF


text: The Corporation maintains comprehensive and continually evolving processes for assessing, identifying, and managing material risks from cybersecurity threats, including any potential unauthorized occurrence on, or conducted through, the Corporation's information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or any information residing on such systems. The processes relating to cybersecurity threats are integrated into the Corporation's overall risk management processes, which are overseen by the entire board of directors and not delegated to any committee or subcommittee of the board.

companyName: PENNS WOODS BANCORP INC


text: We have vendor management processes to manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Tectonic Therapeutic, Inc.

ticker: TECX


text: While Fluence's board of directors oversees all enterprise risks, the Audit Committee of our board of directors has primary responsibility for overseeing cybersecurity risks and management's implementation of our cybersecurity risk management program. The Audit Committee receives quarterly updates from CIO. These updates typically cover topics such as: overview of material cybersecurity incidents that have occurred since the last update, overview of residual cybersecurity risks to our critical business assets, recent investments in our cybersecurity program, and relevant cybersecurity operational metrics. The Audit Committee will report updates regarding cybersecurity to the Board, as it deems appropriate.

companyName: Fluence Energy, Inc.

ticker: FLNC


text: The CIRT maintains an internal execution and communication plan that is designed to measure the impact, assess initial materiality, record the incident, invoke the incident response plan, and communicate the occurrence of certain cybersecurity events or incidents to appropriate members of senior management (including the CMAC) within established procedural time frames. This communication hierarchy includes protocols for informing the Chief Executive Officer, Audit Committee, and the full Board of certain cybersecurity events or incidents and for determining the materiality thereof.

companyName: FOSTER L B CO

ticker: FSTR


text: The cybersecurity programs include a cross-function team of trained internal and external information security professionals, all of whom are required to maintain industry accredited certifications. We have an Incident Response Team chaired by our Chief Operating Officer that is comprised of executive management and designated managers, including the CISO. The purpose of our incident response plan is to manage incidents, including information security incidents, efficiently and effectively to minimize loss and destruction, mitigate weaknesses, restore services, notify customers, as required by law, comply with regulatory requirement and any third-party obligations.

companyName: FLUSHING FINANCIAL CORP

ticker: FFIC


text: 2024, we were part of an elaborate phishing scam that resulted in a loss and as a result we enabled additional cybersecurity procedures to ensure this does not occur again, and established new checking accounts to mitigate any further losses. Other than this one incident, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: VIVOS INC

ticker: RDGL


text: Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security organization, many of whom hold cybersecurity certifications such as a Certified Information Systems Security Professional (CISSP), Certified Data Privacy Solutions Engineer (CDPSE), or Security+ and through the use of technological tools and software and results from third-party audits. Our cybersecurity incident response framework is governed by a cybersecurity incident response plan, which sets out our approach for categorizing, responding to, and mitigating cybersecurity incidents. We have an incident response team comprised of our CISO, executive leaders, management and internal and external legal counsel, whose primary responsibilities include: • Evaluating and validating the impact of an incident; • Approving certain incident response countermeasures and remediation actions; • Escalating incidents and response countermeasures for approval; and • Acting in an advisory capacity in support of cybersecurity incident remediation, as appropriate.

companyName: Pediatrix Medical Group, Inc.

ticker: MD


text: The Company has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition. However, the Company continues to face risks from cybersecurity threats and incidents that, if realized, may have such material effect. Despite its ongoing efforts, the Company cannot provide complete assurance that its information security program will be effective in detecting, preventing, or mitigating such cybersecurity risks. See also "We have undertaken a multi-year initiative to upgrade our digital and information technology systems and capabilities. We significantly rely on our, and our third-party service providers', ability to successfully implement, upgrade and sustain information technology systems and to protect associated data and system availability" and "Any significant compromise or breach of our data security, including the security of customer, associate, third-party or Company information, could have a material adverse effect on our reputation, results of operations, financial condition and cash flows" in Item 1A. Risk Factors of this Annual Report on Form 10-K for a discussion of cybersecurity risks that could have a material impact on the Company, which sections should be read in conjunction with this Item 1C.

companyName: Bath & Body Works, Inc.

ticker: BBWI


text: Our CIO, CISO, and VP of Cybersecurity, each with 20+ years of related experience, are responsible for the day-to-day management of our cybersecurity program and cybersecurity risks. Our CISO and team are primarily responsible for our overall cybersecurity risk management program and supervise both internal and external resources to identify, protect against, detect, respond to, and recover from cybersecurity risks, threats, and incidents.

companyName: AeroVironment Inc

ticker: AVAV


text: As of the date of this report, no cybersecurity incidents have had, either individually or in the aggregate, a material adverse effect on our business, financial condition or results of operations. Notwithstanding the comprehensive approach we take to information security, there can be no assurance that our security efforts and measures, and those of our third-party service providers, will prevent or mitigate all incidents that could have a material adverse effect on our business, financial condition or results of operations. For additional information regarding the risks to us associated with cybersecurity incidents, see Item 1A entitled "Risk Factors."

companyName: CASEYS GENERAL STORES INC

ticker: CASY


text: The multi-layered framework on which our cybersecurity and information security program is built incorporates cybersecurity standards and certain requirements of the National Institute of Standards and Technology ("NIST") Special Publication 800-171—Protecting Controlled Unclassified Information in Non-Federal Systems and Organizations—along with other legal and regulatory requirements. However, this does not mean that we meet any particular technical standards, specifications, or requirements, but rather that we use NIST and other cybersecurity standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: TransDigm Group INC

ticker: TDG


text: The Simpson Information Security Team monitors information security risks that target both technology and manufacturing environments and identifies potential risks to Simpson's information security posture. Any identified risks are prioritized in terms of impact to Simpson's information security posture and, if critical, addressed immediately or added to Simpson's information security roadmap. To supplement our internal cybersecurity resources, we also engage external third parties to perform information security assessments, penetration tests and related services to enhance our information security program.

companyName: Simpson Manufacturing Co., Inc.

ticker: SSD


text: The CISO regularly updates executive management on cybersecurity risks and incidents. Significant cybersecurity matters and certain strategic risk management decisions are escalated to the Audit Committee and the Board.

companyName: Civeo Corp

ticker: CVEO


text: The Information Security o rganization works collaboratively across the company to help protect the company's information systems from cybersecurity threats and to respond to cybersecurity threats and incidents. The Information Security organization monitors information systems to detect anomalies, including attempted cyber attacks, as well as user activity for access controls and risks of insider threat. The Information Security organization also monitors and investigates cybersecurity incidents through detection tools, reports from end users, and other cybersecurity threat and vulnerability intelligence. The Information Security organization also shares and obtains information on cybersecurity threats through participation in the Financial Services Information Sharing and Analysis Center, referred to as FS-ISAC, a member-driven organization that advances cybersecurity and resilience in the global financial system.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: In our asset management business, our board of directors' oversight of cybersecurity risk management is supported by the audit committee of the AGM Board of Directors (the "AGM Audit Committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. Our board of directors, the AGM Audit Committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from the Company's risk management professionals, the Company's Chief Security Officer ("CSO"), CISO, other members of management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from Technology, Legal, Compliance, and ERM. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, the AGM board and/or the AGM Audit Committee receive quarterly risk updates from our risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM board or the AGM Audit Committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from AHL's CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.

companyName: Apollo Global Management, Inc.

ticker: APO


text: We perform regular third-party assessments of the Cybersecurity Program, and retain specialized third-party forensics experts for escalation of certain cybersecurity incidents. In addition, we have processes, including formal security reviews and suspicious activity monitoring, to assess cybersecurity risks associated with our use of third-party service providers.

companyName: OUTFRONT Media Inc.

ticker: OUT


text: Our cybersecurity incident response framework is governed by a corporate Cybersecurity Incident Response Plan (the "IRP"), which sets out our approach for categorizing, responding to, and mitigating cybersecurity incidents. The IRP provides definitions of key terms, stakeholder roles and responsibilities, and a response governance and escalation process.

companyName: DXP ENTERPRISES INC

ticker: DXPE


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. The responsibility for oversight of risks from cybersecurity threats rests with our entire Board, but the Audit Committee oversees certain cybersecurity related items as described below. At least twice per year the entire Board receives an overview from management on our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, and cybersecurity threat risks or incidents and developments, as well as the steps management took to respond to such risks. Additionally, our Chief Information Officer attends Audit Committee meetings to present cybersecurity information for consideration in financial reporting, as necessary, and attends private Executive Sessions with the Audit Committee. Our Director of Internal Audit reports to the Audit Committee regarding attack and penetration exercise results and remediation. Members of the Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news or events and discuss any significant updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of matters such as enterprise risk management, operational budgeting, mergers and acquisitions, and other relevant matters. The Board has also recently participated in a tabletop exercise associated with cyber threats.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: Related to Cybersecurity Risks EastGroup's cybersecurity risk management process is assessed and managed by a cyber risk committee ("Cyber Risk Committee"), which includes the Company's Chief Financial Officer ("CFO"), Chief Information Officer ("CIO") and members of management within the information technology, finance and accounting, legal and internal audit functions. The CIO is a Certified Public Accountant ("CPA"), a Certified Information Technology Professional with the American Institute of CPAs and has 20 years of experience in the areas of cybersecurity and information technology. Collectively, other members of the Cyber Risk Committee have technical expertise and experience in accounting, financial reporting and auditing, and law and compliance.

companyName: EASTGROUP PROPERTIES INC

ticker: EGP


text: The Company has experienced cyber threats resulting in immaterial cyber incidents and expects cyber threats to continue with varying levels of sophistication.

companyName: AMN HEALTHCARE SERVICES INC

ticker: AMN


text: Our CISO leads a dedicated internal Global Information Security ("GIS") team that is responsible for leading enterprise-wide information cybersecurity strategy, policy, standards, architecture, and processes, all of which are designed to prevent, detect and respond to information security threats, as further described in "—Cybersecurity Strategy" above. The CISO's experience includes more than 20 years in the security and fraud profession in multiple high-risk industries, including the critical infrastructure sector, and encompasses various cybersecurity leadership roles and almost seven years as a CISO. She is a Certified Information Systems Security Professional (CISSP) and has a Master's Degree in Information Systems Management.

companyName: Anywhere Real Estate Group LLC


text: Program Assessment. We continuously evaluate and seek to improve and mature our cybersecurity processes. Our cybersecurity program is regularly assessed through management self-evaluation and ongoing monitoring procedures to evaluate our program effectiveness, including assessments associated with internal controls over financial reporting as well as vulnerability management through active discovery and testing to validate patching and configuration. Additionally, our Internal Audit function regularly assesses our program effectiveness through audits of our entities, systems and processes to help maintain compliance with policies. As cybersecurity threats are continuously evolving, we also periodically engage with third parties to perform maturity assessments of our program to identify potential risk areas and improvement opportunities. This includes assessment of our overall program, policies and processes, compliance with regulatory requirements and an overall assessment of key vulnerabilities. We use these assessments to supplement our own evaluation of the overall health of our program and target improvement areas. Several external organizations also evaluate our enterprise cybersecurity program, including the U.S. Defense Contract Management Agency (DCMA) and Cybersecurity Maturity Model Certificate (CMMC) Third Party Assessment Organization. Moreover, some of our products are audited or reviewed for regulatory compliance certification pursuant to the relevant DoD risk management framework.

companyName: RTX Corp

ticker: RTX


text: We have not identified any cybersecurity threats that have materially affected our ability to conduct our business or our financial standing. Refer to the risk factor captioned " Our internal information technology systems, or those of our partners, third-party CROs or other contractors or consultants, may fail or suffer cybersecurity incidents, including related to data protection and privacy laws and adversely affect our business and operations " in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on our Company.

companyName: Adaptimmune Therapeutics PLC


text: Board of Trustees Oversight The board of trustees oversees our cybersecurity risks by periodically evaluating cybersecurity reports from senior management, including the CIO and CISO, as well as reports from the board committees and third-party consultants. The Risk Committee oversees our enterprise risk management framework including risks associated with data security, cybersecurity, IT infrastructure, and data privacy. The Audit Committee oversees the internal and external auditors' review of our cybersecurity risks.

companyName: PennyMac Mortgage Investment Trust

ticker: PMT


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the Cyber Risk Institute's cybersecurity profile designed specifically for the financial services industry, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer, along with key members of our risk team, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: FIRST UNITED CORP/MD/

ticker: FUNC


text: The CISO is responsible for administration, management, and oversight of the Information/Cybersecurity Program; and is supported by a team of individuals that possess various levels of educational and technical hands-on expertise to carry out daily responsibilities and to ensure the Program's success and continued maturation. The CISO reports directly to the Chief Information Officer and has over 15 years of direct experience in designing, implementing, and maturing information and cybersecurity strategies within the financial sector. Prior to joining the Bank, the CISO served as a technology examiner for one of the three Federal banking regulatory agencies, with over ten years of experience performing technology examinations of financial institutions and financial institutions service providers primarily within the New York metropolitan area.

companyName: FLAGSTAR BANK, NATIONAL ASSOCIATION

ticker: FLG


text: The Information Security Office is comprised of professionals who collectively have significant experience in a wide range of cybersecurity matters, including threat assessment and detection, incident response and secure software development, and risk management. The Information Security Office works with Dynatrace's other business and corporate functions and keeps the CISO informed and updated regarding key cybersecurity-related matters in accordance with our internal reporting processes.

companyName: Dynatrace, Inc.

ticker: DT


text: We maintain a data protection and cybersecurity risk management program based upon the National Institute of Standards and Technology (NIST) Cybersecurity framework and the Cybersecurity Maturity Model Certification (CMMC) program to assess, identify and manage cybersecurity risks. As part of this program, we maintain defensive network perimeter safeguards, internal mitigation and control features, continuous system and network monitoring, and contingency data protection. In the event of an incident, we intend to follow our detailed incident response plan, which provides a step-by-step framework to follow from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board of Directors, as appropriate.

companyName: ESCO TECHNOLOGIES INC

ticker: ESE


text: Board of Directors holds oversight responsibility over our Group's risk management and strategy, including material risks related to cybersecurity threats. The Board of Directors oversees the management of our Group's major financial risk exposures, the steps management has taken to monitor and control such exposures, and the process by which risk assessment and management is undertaken and handled, which would include cybersecurity risks, in accordance with its charter. The Board of Directors holds regular meetings and receives periodic reports from management regarding risk management, including major financial risk exposures from cybersecurity threats or incidents.

companyName: EvoAir Holdings Inc.

ticker: EVOH


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust’s business, financial condition, results of operations, or cash flows. See Item 1A. “Risk Factors – Cybersecurity Risks.”

companyName: SAN JUAN BASIN ROYALTY TRUST

ticker: SJT


text: We are developing a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Douglas Emmett Inc

ticker: DEI


text: We are not aware of having experienced any material cybersecurity incidents. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions.

companyName: SOLESENCE, INC.

ticker: SLSN


text: The audit committee of the Board oversees the Company's risk management program, including the management of risks arising from cybersecurity threats. The audit committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. When necessary, the Board receives prompt and timely information regarding any material cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed. On a semi-annual basis, the audit committee of the Board discusses the Company's approach to cybersecurity risk management with the Company's Head of Information Technology.

companyName: Cullinan Therapeutics, Inc.

ticker: CGEM


text: While everyone at the Company plays a part in managing cybersecurity risks, oversight responsibility is shared by the Board of Directors, the Audit Committee, and management. The full Board of Directors receives an annual information technology report and an update from management, which includes an update on our cybersecurity efforts. The Board of Directors has delegated to the Audit Committee the review of the quarterly cybersecurity reports from management, which outline our cybersecurity risk management framework and include updates on our completed, on-going, and planned actions relating to cybersecurity risks.

companyName: Amcor plc

ticker: AMCR


text: The Audit Committee of the Board oversees the Company's IT security programs, including cybersecurity, which includes review of possible external threats and potential mitigations. The Board also reviews the Company's cybersecurity program at least annually. In this review, the CIO briefs the full Board on cybersecurity and data protection matters, including analysis and review of the measures implemented by the Company to identify and mitigate cybersecurity risks. Occidental also has protocols by which material cybersecurity incidents are to be reported to the Audit Committee and/or the Board.

companyName: OCCIDENTAL PETROLEUM CORP /DE/

ticker: OXYWS


text: implementation of a comprehensive cybersecurity policy that encompasses but is not limited to social media, acceptable use (devices, wireless, remote access, internet use), information governance, monitoring, authentication, encryption, vulnerability management, third-party management, and recovery;

companyName: Healthcare Triangle, Inc.

ticker: HCTI


text: To date, Cybersecurity threats, including any previous Cybersecurity incidents, have not had a material impact nor, are they anticipated to significantly affect the Assignor Limited Partner, including our business strategy, results of operations or financial condition.

companyName: BCTC IV ASSIGNOR CORP


text: To date, we have not experienced any cybersecurity incidents that have had a material effect on the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and enhance the resiliency of our networks and to strengthen our internal controls and processes, which are designed to help protect our systems and infrastructure, and the data they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."

companyName: MERCURY SYSTEMS INC

ticker: MRCY


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external security personnel threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us and alerts and reports produced by security tools deployed in the IT environment.

companyName: FENNEC PHARMACEUTICALS INC.

ticker: FENC


text: Certain of our systems and those of our third-party service providers have experienced cybersecurity threats. Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. Additional information about cybersecurity risks we face is discussed in "Item 1A. Risk Factors," which should be read in conjunction with the information above.

companyName: MITEK SYSTEMS INC

ticker: MITK


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Our management receives briefings from our CISO on our cyber risk management program and escalates matters to the Board as needed.

companyName: ServiceTitan, Inc.

ticker: TTAN


text: Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risk strategy and governance and of other information technology risks to the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity.

companyName: BriaCell Therapeutics Corp.

ticker: BCTX


text: To address risks from cybersecurity threats, we have implemented and maintain cybersecurity policies and procedures, including an incident response plan, and our managed services provider implements a number of cybersecurity technologies and controls, including but not limited to, vulnerability scans and patch management tools. Our current approach to managing cybersecurity risks is informed by periodic risk assessments conducted by our managed services provider that incorporates elements of a recognized industry framework and evaluates our cyber risk management controls. We have implemented a process for senior management to review assessments performed and determine the appropriate treatment of identified risks.

companyName: SWK Holdings Corp

ticker: SWKH


text: Our cybersecurity coordinator is responsible for assessing and managing our material risks from cybersecurity threats, in close collaboration with our IT team and report to our CEO. This ensures that the senior management are kept abreast of the cybersecurity posture and potential risks faced by the Company.

companyName: Ainos, Inc.

ticker: AIMD


text: Our CDIO and VP of Platforms, Infrastructure and Cybersecurity also monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through the same processes described above for the identification and management of material cybersecurity risks.

companyName: AVIS BUDGET GROUP, INC.

ticker: CAR


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We have not currently engaged any third party service providers to support, manage, or supplement our cybersecurity processes.

companyName: Wilhelmina International, Inc.

ticker: WHLM


text: The Company's Information Technology Technician (the "IT Technician") is responsible for completing additional mandatory training to understand the processes, procedures, and technical requirements for securing information assets across the Company.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: Our business strategy, results of operations, and financial condition have no t been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.

companyName: MOBIVITY HOLDINGS CORP.

ticker: MFON


text: Board of Directors The Audit Committee of the Board of Directors has responsibility for oversight of information and cybersecurity risks and assessment of cyber threats and defenses, and it oversees management to ensure that the processes designed, implemented, and maintained with respect to such risks are functioning as intended and adapted when necessary to respond to changes in our strategy, as well as emerging risks. Given the importance of information security and cybersecurity to our stakeholders, our Audit Committee reviews quarterly reports from our CISO regarding the Company's cybersecurity strategies for mitigating known risks, any newly identified risks, existing projects, and key performance insights and engages in discussions with management based on such reports and other recent developments.

companyName: STEVEN MADDEN, LTD.

ticker: SHOO


text: The Board, in coordination with the Audit Committee, oversees the Company's policies with respect to the assessment and management of risks from cybersecurity threats. The Board receives updates regarding cybersecurity risks primarily in connection with its oversight of the Company's risk management practices. The Audit Committee receives updates regarding cybersecurity risks from the Company's Chief Information Security Officer (CISO) and Chief Information Officer (CIO), including with respect to the assessment and management of such risks and recent developments, trends and the general threat environment, on at least a quarterly basis.

companyName: PHINIA INC.

ticker: PHIN


text: However, we recognize the importance of cybersecurity and are in the process of developing more robust strategies. We plan to: Develop a Cybersecurity Framework: Establish a formal risk assessment process to identify vulnerabilities. Engage Cybersecurity Expertise: Consider hiring or consulting with cybersecurity professionals to guide our strategy. Implement Training: Begin employee training on cybersecurity awareness to prevent common threats like phishing.

companyName: T3 Defense Inc.

ticker: DFNS


text: Our continually evolving cybersecurity strategies are informed by multiple threat intelligence resources, the status of ongoing remediation plans, and technical developments. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item 1A. "Risk Factors – Risks Related to Our Business — Failure to protect our IT Systems and Confidential Information against breakdowns, security breaches, and other cybersecurity risks could result in financial penalties, legal liability, and/or reputational harm, which would adversely affect our business, results of operations, and financial condition."

companyName: Endeavor Group Holdings, Inc.


text: Board Oversight of Cybersecurity Our board has a strong focus on cybersecurity. Our approaches to cybersecurity and privacy risk are overseen by the audit committee. At each regular meeting of the audit committee of our Board of Directors, our Chief Risk Officer, Chief Compliance Officer, Chief Security Officer, Chief Information Security Officer and Chief Audit Officer provide reports relating to existing and emerging cyber and data security risks, as well as reports on the Company's risk assessments and security incidents. Our audit committee chairman reports on these discussions to our board of directors on a quarterly basis. See Item 1A Risk Factors for discussion of material risks faced by the Company, including risks related to cybersecurity.

companyName: Fidelity National Financial, Inc.

ticker: FNF


text: Risk Management and Strategy recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Our integration involves regular, systematic reviews and assessments conducted alongside other operational risks inspections. The findings from these reviews are communicated across relevant departments timely to inform decision-making. We have not engaged outside assessors, consultants, auditors or third parties in connection with such processes. We have processes to oversee and identify such risks from cybersecurity threats associated with our use of any third-party provider. Such processes include conducting due diligence assessments for all vendors, regularly reviewing vendor security practices, and including cybersecurity performance metrics in our vendor contracts to ensure they comply with our security requirements.

companyName: ENTREPRENEUR UNIVERSE BRIGHT GROUP

ticker: EUBG


text: Our management team is responsible for oversight and administration of our cyber risk management protocol, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Audit Committee also provides oversight of risks from cybersecurity threats.

companyName: Forza X1, Inc.


text: Governance – Board Oversight and the Role of Management The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.

companyName: SANDRIDGE ENERGY INC

ticker: SD


text: The Innovation and Cyber Committee reviews our cybersecurity risk across the enterprise at least annually, including IT, supply chain and products and our cybersecurity strategy framework and operational posture. The Innovation and Cyber Committee also reviews our IT, data security and other systems, processes, policies, procedures and controls at least annually to (a) identify, assess, monitor and mitigate cybersecurity risks; (b) identify measures to protect and safeguard against cybersecurity threats and breaches of confidential information and data and IT infrastructure and our other assets or assets of our customers or other third parties in our possession or custody; (c) support the response and management of cybersecurity threats and data breach incidents; and (d) aid in compliance with legal and regulatory requirements governing cybersecurity or data security reporting requirements.

companyName: L3HARRIS TECHNOLOGIES, INC. /DE/

ticker: LHX


text: The Company's Director of Operations & Administration, with assistance from our third-party cybersecurity vendors, is responsible for identifying, assessing and managing the Company's cybersecurity threats and risks. Together, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, and evaluating threats reported to us.

companyName: Landos Biopharma, Inc.


text: All employees and contractors are required to participate in continuous and dynamic security awareness training. The training includes an overview of key security topics, policies, and responsibilities. Regular security bulletins are disseminated to employees and contractors with security alerts, tips and best practices, external resources, security procedures, and contact information so that they can ask security-related questions or raise concerns.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face unknown cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information. We continuously work to enhance our cybersecurity risk management program.

companyName: Sharplink, Inc.

ticker: SBET


text: We execute penetration testing against our technical environment and processes, and continuously monitor our network and systems for signs of intrusion. We also retain consultants to enhance our penetration testing program with current trends and methodologies utilized against other companies, ensuring we are proactively reducing risk from emerging threats. In addition, we conduct tabletop exercises to prepare for responding to potential cybersecurity events.

companyName: TEXTRON INC

ticker: TXT


text: Our business continuity program includes the maintenance of resources necessary to protect us from potential loss during a disruption, which includes the unavailability of information technology assets due to unintentional events like fire, power loss, and other technical incidents such as hardware failures. The business continuity program includes, among other items, business impact analysis for developing effective plans and a disaster recovery plan to respond, recover, resume, and restore technology assets critical for us to operate.

companyName: Federal Home Loan Bank of Indianapolis


text: As part of Onex Corp.'s ongoing cybersecurity operations, the cybersecurity team regularly conducts testing to identify vulnerabilities that could be exploited by attackers often using various automated tools as well as a managed service provider. The team examines and validates the cybersecurity program and cyber risk posture annually with third parties, measuring it against industry standards and established frameworks, such as the National Institute of Standards and Technology ("NIST"), Center for Internet Security and the International Organization for Standardization (ISO). Onex maintains a comprehensive Security Incident Response Policy, an Incident Response Plan, and Incident Response Playbooks to ensure that any non-routine events are properly investigated and escalated where necessary. On an annual basis, these plans, policies and processes are validated and practiced with senior executives and representatives from key areas of the firm through a cyber-incident tabletop simulation exercise. Onex Corp. engages with a Managed Security Services Provider (the "MSSP") who conducts vulnerability scanning and cyber threat intelligence on a weekly basis at minimum. Additionally, third-party cybersecurity consultants are engaged to perform penetration testing on a bi-annual basis. The findings are reviewed, prioritized and remediated in alignment with the recommendations from the external consultant. In addition to Onex Corp.'s cybersecurity team's internal exercises to test aspects of its cybersecurity program, Onex Corp. periodically engages independent third parties to assess the risks associated with its information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of enterprise information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of the cybersecurity systems and processes.

companyName: Onex Direct Lending BDC Fund


text: To manage the risks identified, the Company implements controls and tests those controls for effectiveness. The Company uses the Federal Financial Institutions Examination Council Cyber Assessment Tool (CAT), the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), the NYSDFS cybersecurity requirements and the Center for Internet Security (CIS) Critical Controls to help inform the Company of best practices for control implementation and potential risk mitigation opportunities that align with defined risk scenarios, and generally as a baseline for best practice control implementation.

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: The foundation of the Company's cybersecurity framework is based on written policies that govern different process areas. Risks are identified through various processes that employees perform through their daily operations and are mitigated, managed and/or governed through these established processes.

companyName: Drilling Tools International Corp

ticker: DTI


text: During the period covered by this report, risks from cybersecurity threats did not have a material impact on the Bank's business strategy, results of operations, or financial condition. The Bank updated its information security strategy during the period covered by this report in response to the increasing volume of cybersecurity threats, both to the Bank and to third parties such as suppliers and vendors. The Bank has experienced cybersecurity incidents and threats in the past, though none have had a material effect on the Bank's financial condition or results of operations.

companyName: Federal Home Loan Bank of San Francisco


text: Our Chief Financial Officer is primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.

companyName: Summit Healthcare REIT, Inc


text: The execution of the Company's cybersecurity processes is overseen by a committee that includes our Chief Information Security Officer, Chief Financial Officer, Chief Operating Officer, General Counsel and Chief Technology Officer. This committee is responsible for the overall cybersecurity strategy and approving the cybersecurity processes, policies, and procedures, including the InfoSec Roadmap. The committee receives regular reports on the InfoSec strategy, risks, and mitigation efforts. It is also informed of any potential reportable information security incidents and is responsible for assessing the impact and approving remediation plans, as well as escalating to the Audit Committee or Board of Directors. Overall implementation of the cybersecurity strategy is executed across the enterprise by Recursion's InfoSec team, which is supervised by the Chief Information Security Officer.

companyName: RECURSION PHARMACEUTICALS, INC.

ticker: RXRX


text: The Board of Directors overall, including the Board Risk Committee more specifically, oversees cybersecurity risk. The Executive Committee overall, and the Chief Risk Officer, Chief Legal Officer, Chief Technology Officer, and Information Security Director more specifically, manages cybersecurity risk and the associated programs at the operational level. Regular updates on cybersecurity are provided to the Management Risk Committee, to the Board Risk Committee and/or the Board of Directors.

companyName: CENTRAL PACIFIC FINANCIAL CORP

ticker: CPF


text: Our Board includes members with skills and experience in cybersecurity, technology, and innovation. The Board ultimately oversees cybersecurity risks and evaluates such risks as part of our enterprise risk management ("ERM") program. As part of our ERM processes, we utilize a formal corporate risk and governance structure that sets out the roles, responsibilities, and expectations of the various parties involved throughout our company in risk mitigation and management. The Risk Committee of the Board is responsible for approving and periodically reviewing and assessing the effectiveness of our ERM policies and procedures. The Risk Committee also assists the Board in its oversight of risks related to cybersecurity by regularly engaging with management and/or third-party consultants to assess the cyber threat landscape; evaluate our information security program; review the results of penetration testing; and analyze the design, effectiveness, and ongoing enhancement of our capabilities to monitor, prevent, and respond to cyber threats and events. The Risk Committee generally meets with management and/or third-party consultants regarding cybersecurity matters on a quarterly basis. Any material developments are reported by the Risk Committee to the Board. Further, any cybersecurity incidents deemed to have a high impact on our business are also generally reported to the Board, regardless of materiality.

companyName: Regional Management Corp.

ticker: RM


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats We maintain an incident response program. In the event of a cybersecurity incident, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain a Cybersecurity Policy, which includes an Incident Response Plan in the event of a significant cybersecurity incident. In the event of a significant cybersecurity incident, our IT Systems Administrator will chair an incident response team to handle the incident. Such incident response team will include members of IT, finance (if applicable), legal, communications, human resources and any affected unit or department. IT, along with a designated forensic team, will use the Incident Response Plan to guide the response.

companyName: Nauticus Robotics, Inc.

ticker: KITT


text: The Company leverages third parties to support the development and independent validation of cybersecurity risk management practices. Third-party cybersecurity risk oversight includes engaging consultants in the development and deployment of cybersecurity control processes, and a managed security services provider to provide 24/7 alert monitoring and remediation services, semi-annual independent vulnerability and penetration tests from rotating providers, and an annual information security audit coordinated by the Company's Internal Audit function.

companyName: EVANS BANCORP INC


text: We have developed and maintained a Cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our Cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a Cybersecurity awareness campaign designed to identify, assess and manage material risks from Cybersecurity threats, including by engaging a third-party Cybersecurity service provider, which communicates directly with our management and compliance personnel. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our Cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving Cybersecurity threats. We may engage external experts, including Cybersecurity assessors, consultants, and auditors to evaluate Cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors, and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party Cybersecurity service provider, material risks from Cybersecurity threats associated with our use of such entities.

companyName: JFB Construction Holdings

ticker: JFB


text: Members of Cohen & Steers' Cybersecurity Management, including the CISO and the CTO, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into Cohen & Steers' overall risk management strategy and communicating key priorities to relevant personnel. Members of Cybersecurity Management, including the CISO and CTO, are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: Management's Role in Cybersecurity Risk Management The Adviser's Chief Technology Officer ("CTO"), internal information technology team and a managed virtual security operations center are responsible for the cybersecurity program applicable to the Company (including enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture, and processes), and along with the Company's CCO, are responsible for assessing and managing material risks from cybersecurity threats that impact the Company. The Adviser's CTO has 20 years of experience in technology, with 10 years advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The Adviser's CTO works closely with Company management to administrator, assess, discuss, and prioritize the Company's cybersecurity efforts.

companyName: AGL Private Credit Income Fund


text: To help identify and manage cybersecurity and information security risks associated with our use of third-party service providers, we have implemented processes to assess third-party systems which could be compromised in a manner that adversely impacts us and our technology systems. We conduct diligence of significant third-party service providers who will have access to our data or information technology systems and incorporate certain cybersecurity protections in our engagement contracts with such providers. In addition, we require such third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations.

companyName: CoreCivic, Inc.

ticker: CXW


text: Our Board has generally delegated the cybersecurity risk oversight function to the Audit Committee. The Audit Committee monitors our Manager's design and implementation of its cybersecurity risk management program.

companyName: Claros Mortgage Trust, Inc.

ticker: CMTG


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place at the corporate level, Formula 1 and QuintEvents. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.

companyName: Liberty Media Corp

ticker: FWONA


text: While to date, we have not had a major cyber incident, nor experienced significant data loss or any material financial losses related to cybersecurity attacks, it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. See Item 1A. "Risk Factors." – "We face significant operational risks because the financial services business involves a high volume of transactions and increased reliance on technology, including risk of loss related to cyber security breaches. " for further discussion of potential risks related to cybersecurity incidents.

companyName: Ponce Financial Group, Inc.

ticker: PDLB


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risk strategy and governance and of other information technology risks to the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Senior management, including the Company's CEO, CFO, and General Counsel, is responsible for assessing and managing cybersecurity risk, and provides briefings regarding the assessment and management of such risk to the Audit Committee, which then reports, as necessary, to the Board of Directors. Although members of our senior management do not have direct cybersecurity expertise obtained through certifications, their experience managing the Company, which includes consulting and coordinating as necessary with a third party information technology expert referred to below, enables them to effectively assess and manage material risks from cybersecurity threats.

companyName: CEDAR REALTY TRUST, INC.

ticker: CDR-PC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by the certain members of Company management, including those who are part of the Company's cybersecurity team. The Company's cybersecurity team is comprised of individuals with expertise in cybersecurity, information technology, risk management, and Company operations. Our cybersecurity team has decades-long experience in cybersecurity and holds industry-standard certifications including Certified Information Systems Security Professional ("CISSP"), and Certified Cloud Security Professional ("CCSP"), among others.

companyName: Willdan Group, Inc.

ticker: WLDN


text: Company and its business units rely on third-party service providers for its products and services to run their information systems.

companyName: Marygold Companies, Inc.

ticker: MGLD


text: Our commitment to cybersecurity includes a total life cycle approach to protecting BD products, manufacturing and distribution OT, enterprise IT and BD data. Using various tools and techniques, we proactively monitor for suspicious activity and perform risk assessments, penetration testing and vulnerability scanning to identify potential threats and vulnerabilities. We also engage independent third parties to conduct cybersecurity assessments and attestations, and we collaborate with government and industry leaders, including industry working groups, to gather and share cybersecurity threat intelligence. We provide mandatory quarterly cybersecurity awareness training tailored to associates' and contractors' role-based responsibilities, and we send phishing simulation emails monthly to all users with a BD email address and an assigned computing device. Where permitted by law, we also use tools to monitor the sharing of personal, confidential and proprietary information to detect intentional or unintentional exfiltration from BD systems. Our cybersecurity risk management program includes a documented incident response and critical incident management plan to identify, assess and manage the potential impact of cybersecurity threats or vulnerabilities and prioritize risk mitigation and/or remediation measures to safeguard BD products, manufacturing and distribution OT, enterprise IT and BD data, including data of our customers.

companyName: BECTON DICKINSON & CO

ticker: BDX


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks arising from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, and we recently established a Cybersecurity Subcommittee to further enhance our cybersecurity oversight. Members of the Cybersecurity Subcommittee are appointed by, and serve at the discretion of, the Board. The Cybersecurity Subcommittee consists of two Board members, both of whom are independent.

companyName: Shuttle Pharmaceuticals Holdings, Inc.

ticker: SHPH


text: Board of Directors' Oversight and Management's Role Our Board of Directors and our Audit Committee oversee risks from cybersecurity threats and our cybersecurity practices. Accordingly, our Board of Directors and our Audit Committee receive regular updates on potential cybersecurity risks and mitigation strategies from the Chief Technology Officer.

companyName: Select Water Solutions, Inc.

ticker: WTTR


text: Security governance We have established processes to assess, identify and manage material risks from cybersecurity threats. Annual risk assessments are performed and incorporated as part of our ERM organizational process. Strategic and operational cybersecurity risks are assessed, identified and managed by our cybersecurity team, which is led by our Chief Information Security Officer (the "CISO"). Our cybersecurity team shares information regarding such risks with our Security Steering Committee, which consists of our Chief Financial Officer, General Counsel, Chief Human Resources Officer, Chief Technology Officer and Chief Supply Chain Officer, and our ERM function, both of which support the Board's oversight of cybersecurity risk.

companyName: PENTAIR plc

ticker: PNR


text: The Board oversees the Company's risk management program, including the management of cybersecurity threats. The Board will receive regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by the Company's peers and third parties. The Board will receive prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Board will discuss the Company's approach to overseeing cybersecurity threats with the Company's Chief Information Security Officer ("CISO") and other members of senior management.

companyName: Amentum Holdings, Inc.

ticker: AMTM


text: Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "Our business, brand, and reputation may be harmed as a result of security breaches, cyber-attacks, employee or other internal misconduct, computer viruses, or the mishandling of personal data" should be read in conjunction with the information above.

companyName: FIRST ADVANTAGE CORP

ticker: FA


text: We utilize a variety of physical security controls to protect our offices and assets from unauthorized access, tampering and environmental hazards. Our systems include third party logging, intrusion detection and penetration systems to monitor our information systems for anomalous and suspicious activity in support of our security objectives and incident management plans.

companyName: Repay Holdings Corp

ticker: RPAY


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • an information security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.

companyName: Health Catalyst, Inc.

ticker: HCAT