text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Head of Information Technology (IT), who is also our Senior Vice President (SVP) of Group Operations and reports to our Chief Financial Officer (CFO), to manage the risk assessment and mitigation process.

companyName: IGM Biosciences, Inc.


text: We maintain a cybersecurity Incident Response Plan ("IRP") designed to identify, assess, manage, mitigate, and respond to cybersecurity risks, threats and incidents. The IRP was developed in consultation with common cybersecurity frameworks, including the Center for Internet Security (CIS) Critical Security Controls Framework, to provide efficiency, familiarity and consistency in design. As part of our IRP, we have established a Cybersecurity Incident Management Team ("CIMT"), comprised of senior level executives and management, that defines overall policy and strategy when faced with a cybersecurity incident. The CIMT provides cross-functional and geographical visibility, as well as executive leadership oversight, to address and mitigate associated risks. Among our CIMT, our VP - IT holds the highest level of executive responsibility for assessing and managing cybersecurity threats, incidents, and risks, as well as developing and implementing all cybersecurity risk management, strategy, and governance recommendations. Our VP - IT leads all components of our information technology functions and reports to our Executive Vice President and Chief Financial Officer.

companyName: Coterra Energy Inc.

ticker: CTRA

secItem: Item 1C


text: Our cybersecurity risk management program is led by our Chief Information Security Officer ("CISO"), whose organization is responsible for identifying, assessing and managing risks from cybersecurity threats. Our CISO has over 20 years of experience leading information security, data risk management, application/system development and engineering teams at multiple large, global and publicly traded companies—including several Fortune 500 companies. Our CISO holds Certified Information Systems Security Professional ("CISSP"), Certified Information Security Manager ("CISM"), Certified Information Privacy Professional ("CIPP") and Security+ certifications and contributes to healthcare industry working groups, most recently serving as chair of the Health Information Sharing and Analysis Center (the "HISAC") Information Security Risk Management Working Group. Our CISO reports to our Chief Information Officer (CIO), who has overall responsibility for the cybersecurity risk management program and organization. Our CIO has more than 25 years of experience in information technology, business transformation, cybersecurity and technology solutions, including leadership roles at multiple large, global and publicly traded companies—including several Fortune 500 companies. Our Vice President, Research and Development, Product Security ("VP of Product Security") also supports our cybersecurity risk management program by leading a team of product security professionals focused on implementing security by design, security in use and product end of life strategies across our portfolio of software-based products. Our VP of Product Security has more than 15 years of experience in the medical device industry, including at another publicly traded company managing product security. Our VP of Product Security has received training from the SANS Institute and contributes to healthcare industry groups such as the Health Sector Coordinating Counsel – Joint Cybersecurity Working Group.

companyName: BECTON DICKINSON & CO

ticker: BDX


text: We engage industry cybersecurity experts to evaluate and review our cybersecurity programs. These external reviews include regular audits, threat assessments, vulnerability scans, simulated attacks and other advice regarding information security practices. We regularly conduct incident response exercises with key stakeholders.

companyName: AECOM

ticker: ACM


text: The Bank has implemented a comprehensive set of information security policies, standards, and related training programs to promote awareness and prevention of cybersecurity risks. All employees are required to: • Review and acknowledge the information security framework upon hiring. • Formally review and understand updates to these policies. • Complete annual training sessions addressing data privacy and security, password protection, internet use, social engineering risks, and other key cybersecurity topics. These efforts ensure employees remain vigilant and informed about evolving threats and best practices.

companyName: FB Financial Corp

ticker: FBK


text: Our board of directors, as a whole and through its committees, holds oversight responsibility for our risk management processes, including risks from cybersecurity threats. Our board of directors exercises its oversight function through the audit committee, which oversees the management of risk exposure across various areas, including cybersecurity risk. The audit committee is comprised of board members with diverse expertise including risk management and technology, which we believe enables the board to oversee cybersecurity risks.

companyName: AtlasClear Holdings, Inc.

ticker: ATCH


text: The Premier Board of Directors has assigned to the Board Risk Committee ("BRC"), along with the ERMC, oversight of risk management, including risks associated with information security and cybersecurity. The BRC is comprised of independent directors of Premier with participation from Premier's executive leadership and additional members of management. The ERMC is chaired by the Chief Risk Officer and, in addition to general oversight of risk management, is responsible for documenting all risks for the organization and reporting to the BRC issues of a critical nature. The ERMC meets monthly and is a cross-functional group comprised of all members of executive leadership and additional members of management from different areas of the Company. The ISOC is responsible for managing and mitigating information security and cybersecurity risks where appropriate and escalates issues to the ERMC. The ISOC is chaired by the CISO and includes select members of executive leadership and representatives from the Risk Management Department and Information Technology Department. The ISOC meets at least monthly. Routine reporting of the status of cybersecurity risks and mitigation activities progress from the ISOC to ERMC and finally to BRC.

companyName: PREMIER FINANCIAL CORP


text: The Company has an enterprise risk management committee comprised of key business and functional leaders to address enterprise risks, and cybersecurity is a risk category addressed by that group. In addition to assessing major risks, management identifies and monitors such risks. At least annually, the Company's executive leadership reviews with the Board of Directors the major risks identified in the enterprise risk management process, as well as the steps identified to mitigate such risks. Each of the business and functional leaders responsible for the management of these identified risks also regularly discuss with the Board changes in assessment of these risks and mitigation plans.

companyName: LA-Z-BOY INC

ticker: LZB


text: PNC's inherent information security risks, the maturity and completeness of the control environment and measurements against our risk appetite are presented quarterly to the Technology Committee by the firm's Chief Technology Risk Officer. Overall risks across the Enterprise Risk Framework are then reported quarterly to the Risk Committee by the Chief Risk Officer.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: The Senior Director of Information Security has over 10 years of experience in senior level information security roles, has over 20 years' experience in Fortune 500 enterprise IT roles, and holds Associate and Bachelor Degrees and the Certified Information Security Manager (CISM) Professional certification, amongst others. The members of our information security management team have extensive experience in technology and security roles, possessing cybersecurity certifications such as Certified Information Systems Security Professional (CISSP), Cisco Certified Network Professional (CCNP) and Global Certified Incident Handler (GCIH), amongst others."

companyName: LITHIA MOTORS INC

ticker: LAD


text: The Board's oversight of cybersecurity risk is supported by our CISO. The CISO attends ITC and ERMC meetings and provides cybersecurity updates to these Board committees. The CISO also provides annual risk assessments and reports regarding the information security program to the full Board of Directors. Our CRO, in conjunction with our CISO, facilitates the involvement of the ITC in oversight of potentially significant cybersecurity incidents.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: The audit committee receives periodic reports from our President, Interim Chief Executive Officer, Chief Financial Officer, and Chief Operating Officer, concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives and has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Kronos Bio, Inc.


text: We also rely on third-party service providers to support our business and operations, which may include processing of confidential and other sensitive data. We are committed to continuing to develop and enhance our onboarding and monitoring processes for third-party vendors to ensure alignment with best practices. Despite our efforts, it's important to note our service providers are ultimately responsible to establish and uphold their respective cybersecurity programs. We have limited ability to monitor the cybersecurity practices of our service providers and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information systems, software, networks, or other assets owned or controlled by our service providers. Notwithstanding our efforts to mitigate any such risk, there can be no assurance that the compromise or failure of supplier information systems, technology assets, or cybersecurity programs would not have an adverse effect on the security of our information systems.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: The CIO provides periodic reports to the Board of Directors and the executive management team, including our Legal Counsel. These reports include updates on our cybersecurity risks and threats, assessments of our information security program, and any changes in the threat landscape. Our information technology systems are regularly evaluated by internal and external consultants with the results of the review reported to the executive management team and the Board of Directors.

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: The foundation of our cybersecurity framework is built on continuous risk management practices. We conduct regular threat assessments, administrative reviews, and vulnerability scans to proactively identify and evaluate cybersecurity risks. Our strategy is developed to be in harmony with our business objectives, incorporating industry best practices, staying abreast of evolving cyber threats, and complying with regulatory standards.

companyName: MONARCH CASINO & RESORT INC

ticker: MCRI


text: Our SVP, IT provides relevant cybersecurity and information technology reports to the Audit and Finance Committee, and to the executive leadership team. These reports are provided at quarterly Audit and Finance Committee meetings and at our quarterly Information Technology Steering Committee ("IT Steering Committee") meetings. These reports typically include analyses of recent significant cybersecurity threats and incidents at the Company and across the industry, as well as a review of our security controls, assessments and program maturity, risk mitigation status, and a review of our third-party service providers as appropriate. Simpson's information security roadmap and posture are also reviewed quarterly with members of the executive leadership team and the Audit and Finance Committee. In accordance with our information security program, any information security event is assessed and reviewed by our IT Steering Committee.

companyName: Simpson Manufacturing Co., Inc.

ticker: SSD


text: We employ and manage various third-party partnerships to help protect us from cybersecurity threats. These organizations provide services such as penetration testing, security assessments, as well as 24 hours per day monitoring, alerting and response, including incident responses, all of which adhere to our overall ERM framework. Our partners evaluate and rank our cybersecurity maturity and coverage as part of their services and keep us informed of emerging global threats. Our digital infrastructure undergoes both internal and external audits as part of our Sarbanes-Oxley audit process and is designed to address the requirements of applicable information security standards and an evolving cyber landscape.

companyName: AMARIN CORP PLC\UK

ticker: AMRN


text: The Company's security team provides oversight and policy guidance on physical, cyber and information security, as well as business continuity, throughout the Company's operations. It is responsible for designing, implementing, monitoring and supporting effective physical and technical security controls for the Company's physical assets, business systems and operational technologies. The Company's security team also conducts annual and ongoing cybersecurity awareness training and education for the Company's employees. In 2024, 100% of the Company's active workforce completed mandatory cybersecurity training. By equipping employees with knowledge and skills, the Company strives to cultivate and maintain a cybersecurity-conscious culture within its workforce.

companyName: American Water Works Company, Inc.

ticker: AWK


text: We engage subject matter experts such as consultants to assist us in establishing processes to assess, identify, and manage potential and actual cybersecurity threats, to actively monitor our systems internally using widely accepted digital applications, processes, and controls, and to provide forensic assistance to facilitate system recovery in the case of an incident. The Enterprise Incident Response Team oversees and establishes the parameters of our engagement with these experts to ensure we obtain the supplement assistance needed in this area, if any. See Part I, Item 1A.—Risk Factors— Our business is subject to cybersecurity risks.

companyName: NABORS INDUSTRIES LTD

ticker: NBR


text: We rely on a series of processes to identify threats, hazards, and other risks to our information assets. We employ a variety of preventative and detective tools from our Managed Security Services provider designed to monitor, detect, block, and provide alerts regarding suspicious and unauthorized activity and to report on suspected advanced persistent threats. In addition to regular risk assessments, we rely on independent assessments, audits, and cybersecurity feeds from vendors, including directly into patch and vulnerability management tools. We engage cybersecurity experts and third-party specialists to perform regular assessments of our infrastructure, software systems and network architecture. We also leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness. We have regular and ongoing security education and training for employees and recovery and resilience tests. The Bank also retains third-party experts to conduct intrusion and penetration testing on an annual basis. All risk and security assessments results are shared with the Board of Directors.

companyName: BayCom Corp

ticker: BCML


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item 1A. "Risk Factors – OPERATIONAL RISKS – We depend on secure information technology and a breach of those systems or those of third-party vendors could result in significant losses, unauthorized disclosure of confidential customer information, and reputational damage, which could materially adversely affect our business, financial condition, and/or results of operations and could lead to significant financial, legal, and reputational exposure" in this Form 10-K.

companyName: SLM Corp

ticker: SLM


text: Our information security team, headed by our Director of IT Cyber Security and Compliance, who reports to our Chief Information Officer ("CIO"), monitors our technology systems to prevent, detect, mitigate and remediate any cybersecurity incidents. Our enterprise-wide cybersecurity program is aligned with the U.S. National Institute of Standards Technology Cybersecurity Framework and the Israel National Cyber Directorate, and we are members of the New Jersey Cybersecurity and Communications Integration Cell. This collaboration enables us to increase our cybersecurity knowledge, threat awareness, and awareness of cyber incidents within the industry. It also helps us take proactive measures to prevent incidents by defining attack group identifiers and implementing learning and improvement processes.


text: As of the date of this filing, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the Company's business strategy, results of operations or financial condition. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company has experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. Given the continuing reports of cyber incidents in general, we believe that the Company will most likely continue to be a target of cybersecurity attacks by bad actors.

companyName: OPPENHEIMER HOLDINGS INC

ticker: OPY


text: Management, including our Chief Information Officer ("CIO"), who has over 25 years of experience serving primarily in the life science industry and is a recognized industry leader, is responsible for monitoring and assessing cybersecurity risks. Management reviews and determines the effectiveness of both internal and third-party leveraged expertise to ensure we have the appropriate knowledge base for risk coverage.

companyName: Lantheus Holdings, Inc.

ticker: LNTH


text: As of August 31, 2024, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. Although cybersecurity risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we face numerous and evolving cybersecurity threats in our business.

companyName: AI Era Corp.

ticker: AERA


text: Our Chief Information Officer who reports to the Chief Financial Officer and has over 30 years of experience managing information technology and cybersecurity matters, together with our executive management team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Legal and Regulatory Requirements."

companyName: EXPRO GROUP HOLDINGS N.V.

ticker: XPRO


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our board of directors in a timely manner.

companyName: SmartStop Self Storage REIT, Inc.

ticker: SMA


text: Risk Management and Strategy BancShares maintains robust processes for assessing, identifying, and managing material risks from cybersecurity threats that are integrated with our overall risk management program. As part of its cybersecurity risk management framework, BancShares leverages a Three Lines of Defense model (the "Three Lines Model") to promote clarity of roles and responsibilities in managing risk. Under the Three Lines Model, the ECSO led by our Chief Information Security Officer (the "CISO"), acts as a first line of defense and has primary responsibility for identifying, assessing, monitoring, and managing material risks from cybersecurity threats. Our CISO reports to our Chief Information & Operations Officer ("CIOO"), who reports directly to our Chief Executive Officer. As a part of the ECSO, Enterprise Incident Management ("EIM") maintains incident response playbooks (i.e., standard operating procedures) to identify, respond, classify, and analyze incidents and events in accordance with BancShares' Enterprise Severity Matrix, and our Security Operation Center identifies, assesses, manages, and monitors potential cybersecurity events with EIM. In addition, BancShares maintains a third-party risk management team tasked with evaluating, identifying, and managing risk from all third-party engagements, including from cybersecurity threats.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function primarily through the audit committee.

companyName: Arcellx, Inc.

ticker: ACLX


text: We are providing cybersecurity training to our employees and plan to continue enhancing this program on an ongoing basis. Regular updates and internal campaigns will ensure that our employees are well-prepared to identify and respond to cybersecurity threats in an effective manner.

companyName: reAlpha Tech Corp.

ticker: AIRE


text: 3. Training and Screening of Employees – The Company provides all Information Security policies to new hires. In addition, new hires are required to complete security awareness training which contains cybersecurity principles. Employees must also complete annual security awareness training, with additional and dedicated cybersecurity training for employees with access to more data and systems. As a part of hiring employees and contractors, background checks are performed that involve varying levels of depth depending on the employee’s or contractor’s level of data and system access.

companyName: QUINSTREET, INC

ticker: QNST


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our IT Assets, including, for example: implementing policies and guidelines governing the individual use and protection of IT Assets by employees, employee training, and leveraging the capability of third-party service providers to support our internal cybersecurity processes. We will continue to monitor proposed cybersecurity disclosure rules from the SEC and alter our procedures accordingly.

companyName: TG THERAPEUTICS, INC.

ticker: TGTX


text: Cybersecurity risk management is part of the Company's global enterprise risk management program. In order to manage the risks associated with cybersecurity threats, the Company has implemented a robust risk-based cybersecurity program consisting of processes, technologies, and controls to assess, identify and manage material risks from cybersecurity threats.

companyName: ILLINOIS TOOL WORKS INC

ticker: ITW


text: As part of the Board's oversight, its Corporate Governance, Nominating and Ethics Committee, which is comprised entirely of independent directors, receives quarterly reports from executive management about the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Board receives at least an annual report from executive management. Additionally, we have processes by which a cybersecurity incident would be escalated internally and, when appropriate, reported to the Board (or appropriate committee), as well as for updating the Board regarding such incident until it has been resolved.

companyName: SUPERIOR GROUP OF COMPANIES, INC.

ticker: SGC


text: Board of Directors' Oversight of Cybersecurity Risks and Management's Role in Assessing and Responding to Cybersecurity Risks Cybersecurity risks are overseen at the board level through the Audit Committee. Our Vice President – IT, together with the security and compliance team, is responsible for the monitoring, assessment and management of cybersecurity risk, and seeks to maintain the security and continuity of our operations. Our Vice President – IT oversees the Company's cybersecurity strategy, cybersecurity and data privacy policies, measures and controls, and Board of Directors and Audit Committee communications on cybersecurity matters. Our Vice President – IT regularly briefs senior management, the Board of Directors and the Audit Committee on cybersecurity issues as part of our overall enterprise risk management program, including quarterly updates to the Audit Committee, which may include information regarding our exposure to privacy and cybersecurity risks, plans and activities to monitor and mitigate privacy and cybersecurity risks, IT governance policies and programs, including our cybersecurity incident response plan, and legislative and regulatory developments that could impact our privacy and cybersecurity risks. Additionally, our Vice President – Risk Management oversees our enterprise risk management process and apprises the Audit Committee and our Board of Directors of all significant risks facing the Company, including cybersecurity risks.

companyName: Antero Midstream Corp

ticker: AM


text: We use a risk-based approach to identify, assess, protect, detect, respond to and recover from cybersecurity threats. Our information security program includes, among other aspects, antivirus and malware protection, encryption and access control, and employee training. Risks identified by the Chief Administrative Officer and other cybersecurity personnel are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed.

companyName: Mama's Creations, Inc.

ticker: MAMA


text: We employ a comprehensive risk management strategy for the assessment, identification and management of material risks stemming from cybersecurity threats. Our methodologies involve a systematic evaluation of potential threats, vulnerabilities, and their potential impacts on our organization's operations, data, and systems.

companyName: VORNADO REALTY LP


text: Senior management, in coordination with the Company's third-party service provider specializing in information technology, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through ongoing communications with the third party service provider, Senior Management monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.

companyName: 22nd Century Group, Inc.

ticker: XXII


text: Our Board of Directors oversees our cybersecurity risk management. Directors receive reports as requested from management, including senior IT leadership and third parties, on cybersecurity matters. Additionally, the Board of Directors is kept informed about cybersecurity risks as part of our overall enterprise risk management program and through regular business updates.

companyName: Outdoor Holding Co

ticker: POWW


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We are subject to cybersecurity risks, including risks related to customer, employee, vendor, and other company data" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: SMITH & WESSON BRANDS, INC.

ticker: SWBI


text: Cybersecurity Risk Management, Governance And Risk Assessment The Company is committed to protecting the confidentiality, integrity, and availability of its information systems and the data they contain from cybersecurity threats. The Company recognizes that cybersecurity is a dynamic and evolving area of risk that requires ongoing assessment, management, and oversight. The Company intends to establish a cybersecurity program (the "Program") that will be designed to assess, identify, manage, and mitigate material cybersecurity threats, as well as to respond to and recover from cybersecurity incidents.

companyName: Elite Health Systems Inc.

ticker: EHSI


text: Under the management and direction of the Chief Information Officer, the CISO is responsible for assessing and managing our material risks from cybersecurity threats. The CISO also has a dotted line reporting relationship to the CRCO for purposes of informing the CRCO on related risks. The cybersecurity risk management function under the CRCO is responsible for identifying, assessing and evaluating cybersecurity risks and monitoring and tracking cybersecurity risk mitigation strategies.

companyName: Federal Home Loan Bank of Indianapolis


text: Although we develop and maintain systems and controls designed to prevent cybersecurity threats from occurring, and we have a process to identify and mitigate threats, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become increasingly sophisticated. Moreover, despite our efforts, the possibility of these events occurring cannot be eliminated entirely. As we outsource more of our information systems to vendors, engage in more electronic transactions with service providers and relating to patients participating in clinical trials, and rely more on cloud-based information systems, the related security risks will increase and we will need to expend additional resources to protect our technology and information systems. In addition, there can be no assurance that our internal information technology systems or those of our third-party contractors, or our consultants' efforts to implement adequate security and control measures, will be sufficient to protect us against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks which could result in financial, legal, business or reputational harm.

companyName: Lantern Pharma Inc.

ticker: LTRN


text: Executive Officers of the Registrant Set forth below is certain information about our executive officers as of February 20, 2024. President, Tim Hortons Canada & U.S.

companyName: Restaurant Brands International Inc.

ticker: QSR


text: Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Plutonian Acquisition Corp.


text: To effectively manage the cyber risk posed to our organization and to remain within our risk appetite, we maintain a cybersecurity strategy and risk management program to identify, assess and manage material risks from cybersecurity threats with the aim of protecting the confidentiality, integrity and availability of our critical systems and information.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: Our Disclosure Committee is comprised of, among others, our Chief Financial Officer, Chief Growth and Operations Officer, CIO, Senior Vice President of Finance, Executive Vice President and Director of Strategic Planning, Senior Vice President of Investor Relations and Treasurer, Senior Vice President of Legal Counsel, Vice President of Legal Counsel, and the most senior members of the financial reporting, internal audit, financial planning and analysis, and tax functions.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: We have implemented a systematic approach to managing our cybersecurity risks and have adopted a comprehensive set of cybersecurity policies that include best practices based on recognized industry standards and guidelines. These policies provide guidance on roles and responsibilities of key stakeholders and promote awareness. These policies also cover cyber education and training as well as help us to align with applicable laws and regulations to meet our compliance requirements. The primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Information Security Officer (CISO) within our GIS organization, who reports to our Chief Technology Officer. The CISO is also responsible for managing the risk assessment and mitigation process. Our CISO has over 13 years of experience serving in various roles in risk management as well as enterprise and cyber security, including serving as the project lead and founder of the Open Worldwide Application Security Project (OWASP) flagship project Security Shepherd, a web and mobile application security training program, and leading IBM's ethical hacking team. He was also a principal security engineer at Axway prior to joining Synchronoss where he served as product security architect and a director of product security prior to accepting the role as our CISO. Our Chief Technology Officer has over 20 years of experience in the telecommunications industry, including serving as our Chief Architect and Senior Software Engineer, during which he oversaw our GIS program, including the governance, risk and compliance management related thereto. We also engage consultants, and other service providers, to help us implement our cybersecurity policies and procedures. These service providers assist us with monitoring security threats and vulnerabilities as well as responding to identified cybersecurity incidents, including prompt escalation and timely communication of major security incidents to senior business leadership and the Audit Committee.

companyName: SYNCHRONOSS TECHNOLOGIES INC

ticker: SNCR


text: Use of Consultants and Advisors We engage with a range of external experts, including cybersecurity assessors, consultants, auditors, and legal counsel in evaluating and testing our risk management systems. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain current.

companyName: Silk Road Medical Inc


text: At the Board level, the Audit Committee is formally tasked with assisting the full Board in overseeing information security systems, including cybersecurity, and reporting to the Board with respect to significant and material developments or proposed changes to the Company's cybersecurity framework. The Audit Committee receives regular reports from the CIO and the Vice President of Information Security and Architecture about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security threats and risks. The Audit Committee also receives regular updates from management on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, and relevant internal and industry cybersecurity incidents and emerging threats.

companyName: Sleep Number Corp

ticker: SNBR


text: We regularly receive vulnerability threat information from our product vendors as well as CIS and other third-party sources. In order to prioritize mitigation efforts, we categorize threats based on likelihood of occurrence and the potential severity of an incident related to the threat. The Information Technology Department reports overall threat collection and mitigation status at least monthly to the CIO and at least quarterly to the Board and ERMC.

companyName: United Parks & Resorts Inc.

ticker: PRKS


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our clients' and our data. We have a global cybersecurity and privacy program to help effectively assess, identify, and manage cybersecurity threat risks. We have developed a list of cybersecurity risks from known threats and our own history to help identify what is most meaningful and potentially impactful to the Company. The cybersecurity and privacy initiatives to address the risks are complex, strategic, and ever evolving. Threats and risks are identified from threat intelligence sources that include our vendors, industry, and government organizations. We continuously monitor and scan the cyber landscape to review evolving threats and risks that may impact us. Information from these various sources are reviewed by our cybersecurity and risk teams to evaluate risks in line with the NIST Cybersecurity Framework. Threat intelligence from other financial institutions and industry consortiums that serve financial institutions, such as the Financial Services Information Sharing and Analysis Center, provides key information on how risks are affecting our industry, with ability to preemptively mitigate emerging threats, as discussed above in Part I, Item 1A of this Form 10-K under the heading Technology and Data Security.

companyName: CRAWFORD & CO

ticker: CRD-A


text: The Audit Committee of the Board oversees our cybersecurity risk management and strategy and has an oversight role that involves reviewing, establishing policies for, and assessing the efficacy of processes used to evaluate significant risk exposures and the measures management implements to mitigate these risks. The Audit Committee is informed about cybersecurity risks through regular management reports on the performance of internal and/or external cybersecurity audits and assessments and the effectiveness of existing cybersecurity practices. The CIO, CISO, other members of the SGC, and other personnel also periodically update the Audit Committee on material cybersecurity risks, significant cybersecurity incidents, mitigation measures and impacts to the Company. The Board receives updates from management, including the CIO, and the Audit Committee on cybersecurity risks on at least an annual basis.

companyName: QuidelOrtho Corp

ticker: QDEL


text: We have processes designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Vice President Legal and Compliance, Vice President Finance and Administration, Chief Financial Officer and Director of Information Technology. In addition, the Company's incident response policy includes a process for reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Larimar Therapeutics, Inc.

ticker: LRMR


text: We use third-party service providers to perform a variety of functions throughout our business, such as software-as-a-service providers, hosting companies, contract research organizations, and contract manufacturing organizations. Depending on the nature of the services provided, the sensitivity of the critical systems, information and assets at issue, and the identity of the provider, we may conduct a review of security assessments provided by the vendor, review the vendor's written security program and/or requested security assessment and security questionnaire responses, and impose contractual obligations on vendors regarding their cybersecurity practices.

companyName: Silence Therapeutics plc

ticker: SLN


text: Cyber Risk Management and Strategy We have processes for assessing, identifying and managing cybersecurity risks, which are informed by industry standards and built into our overall enterprise risk management f unction and are designed to help protect our information assets and operations from internal and external cyber threats, and to protect employee, collaborator and patient information from unauthorized access or attack.

companyName: Scholar Rock Holding Corp

ticker: SRRK


text: We have established procedures to evaluate and respond to cybersecurity incidents, including cybersecurity incidents at third-party service providers which have a potential to impact our data and systems. Our cybersecurity risk management is intended to address such risks, as well as other risks related to third parties.

companyName: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.

ticker: PACB


text: With respect to cybersecurity risk, we have a dedicated security engineering and operations team, supplemented with security consultants and two managed security service providers, that performs first line responsibilities by identifying security risks, deciding if and how to implement security tools and controls, and implementing and maintaining those tools and controls. This team is led by our Director of Technical Services, who has 32 years of information technology experience, and reports to our Chief Information Officer (CIO), who has 40 years of information technology experience. We also have an information security governance team that is responsible for performing second line responsibilities, including training associates, providing advice to our associates in carrying out their responsibilities consistent with the goals of the security program, assessing whether the program is reasonably designed and operating effectively, and responding to and reporting to stakeholders on the reasonableness and effectiveness of the security program. The information security governance team is led by our Chief Information Security Officer (CISO), who is a Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP) and has 37 years of experience in the field of cybersecurity. Our CISO reports directly to our Chief Legal Officer and General Counsel. Together, these teams maintain a robust information security program that utilizes a multi-layered defense-in-depth strategy and is designed to prevent, detect, mitigate and remediate cybersecurity incidents.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: In an effort to detect vulnerabilities or cyber breaches that we have not yet discovered, we regularly run an exhaustive security testing framework, including scanning all internal and external assets for vulnerabilities, utilizing multiple third-party security testing teams every year, and maintaining a bug bounty program.

companyName: Teads Holding Co.

ticker: TEAD


text: Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk. They receive at least quarterly reports, or more frequently if deemed necessary, from management about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Audit Committee directly oversees our cybersecurity program. The Audit Committee receives regular updates from management on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.

companyName: PGT Innovations, Inc.


text: Our Board is responsible for overseeing our enterprise risk management activities in general, and each of its committees assists in this role of risk oversight. Our Board has delegated the monitoring and oversight of risks related to cybersecurity and information technology to our Audit Committee, which regularly reports to our Board regarding its activities, including those related to cybersecurity risk management. Our Board also receives periodic briefings from management on our cybersecurity risk management program, including presentations on cybersecurity topics from our Chief Technology Officer, internal information security team and third-party experts.

companyName: Vivid Seats Inc.

ticker: SEAT


text: As reflected in the audit committee charter, the audit committee oversees our processes and policies relating to certain risk assessment and risk management matters, including with respect to cybersecurity risks. The audit committee administers its risk oversight function by receiving periodic reports from members of senior management on areas of material risk to our company. Our audit committee discusses our cybersecurity program at least annually, receives updates on relevant developments and considers steps that our management has taken to monitor and seek to mitigate any risk exposures.

companyName: Terreno Realty Corp

ticker: TRNO


text: Key elements of Atkore's annual Enterprise Risk Management ("ERM") program include an inventory and classification of key risk areas and topics; a methodology for scoring risks based on the risk's probability, severity, and velocity of impact, and for trending key risks; and a framework for developing and implementing countermeasures for key risks. Cybersecurity is one of six topical areas required to be addressed as part of the annual ERM program. Cybersecurity risks are scored using the same methodology applied to all other risks. This helps evaluate the significance and prioritization of cyber-related risks relative to wider business risks. Members of Internal Audit present annually to the Atkore Board of Directors a report on the results of the ERM process. This includes cybersecurity risks. We periodically engage external consultants to assess our cybersecurity program.

companyName: Atkore Inc.

ticker: ATKR


text: Our CISO has an undergraduate degree in Management Information Systems, decades of cybersecurity and technology experience and broad industry-wide experience, including in hospitality, retail, medical, energy and government. Members of our cybersecurity team have over 100 years of combined cybersecurity experience and hold professional certifications from security organization such as ISC2 and SANS Institute that include Certified Information Systems Security Professional (CISSP), GIAC Web Application Penetration Tester (GWAPT), GIAC Penetration Tester (GPEN), GIAC Certified Intrusion Analyst (GCIA) and GIAC Certified Forensic Analyst (GCFA). Our cybersecurity team also stays informed on the latest developments in cybersecurity, including trends, risks, threat vectors and attack mechanisms, through security and compliance-related seminars, conferences, continuing education training, news feeds and forums and our CISO sits on various CISO committees and roundtables. Our CISO's knowledge and experience, coupled with the expertise and advice we receive from third parties, are instrumental in assessing and managing our cybersecurity program, including our strategy, security engineering, security operations, cybersecurity awareness and training, information technology governance and compliance, and cyber threat identification, assessment, management, mitigation and response.

companyName: Life Time Group Holdings, Inc.

ticker: LTH


text: In evaluating the risks identified as a result of the annual cybersecurity assessment process, our cybersecurity partners assist the Company to assess the likelihood, severity, and impact of relevant risks, including the impact on employees, stakeholders, and vendors. These risks are prioritized and monitored by the cybersecurity partners and management of the Company.

companyName: Banzai International, Inc.

ticker: BNZI


text: Role of Management We have established a cross functional Information Security Steering Committee ("ISSC") with executives from our Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at the corporate level and our subsidiaries.

companyName: Liberty Media Corp

ticker: FWONA


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies and other processes to assess, identify and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is assessed periodically by independent third parties. We have processes in place to assess, identify, manage and address material cybersecurity threats and incidents. These include, among other things: (i) annual and ongoing security awareness training for employees; (ii) mechanisms to detect and monitor unusual network activity; and (iii) containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business, and have processes to assess those issues for potential cybersecurity impact or risk. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including maintaining an effective security management program and abiding by information handling and asset management requirements. We have an escalation process in place to inform our senior management and our Board of Directors of these material issues.

companyName: KonaTel, Inc.

ticker: KTEL


text: Because we are aware of the risks associated with third-party service providers, we have implemented processes to oversee and manage these risks, including security assessments of all third-party providers before engagement. In addition, cybersecurity program maturity of such third parties, including incident response and disclosure, is also evaluated.

companyName: LAUREATE EDUCATION, INC.

ticker: LAUR


text: We have experienced, and may in the future experience, whether directly or through our supply chain or other channels, cybersecurity incidents. While prior incidents have not materially affected our business strategy, results of operations or financial condition, and although our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations or financial condition. See "General Risk Factors" in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: SONIC AUTOMOTIVE INC

ticker: SAH


text: We prioritize investment in cybersecurity risk management and governance. We continually assess the adequacy of our resources and capabilities to address emerging threats, regulatory requirements, and changes in technology. As cybersecurity threats evolve, we may need to further enhance our processes and technologies, which could require additional financial resources.

companyName: SM Energy Co

ticker: SM


text: At the management level, our Cyber Security and Risk departments work together to monitor our cybersecurity and risk programs, reporting to our VP of Cybersecurity and CRO, respectively. Our VP of Cybersecurity currently leads a team of cybersecurity professionals, has held leadership roles in the Cybersecurity team since joining us in 2019, and has over fifteen years of management experience within cybersecurity teams. Our CRO has held leadership roles in internal audit and risk for over a decade, including most recently as CRO of another public company.

companyName: iRhythm Holdings, Inc.

ticker: IRTC


text: We have implemented and maintain information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our clinical trial data ("Information Systems and Data").

companyName: CalciMedica, Inc.

ticker: CALC


text: We presently do not engage third parties to assist us with the assessment, identification or management of cybersecurity risks, or in evaluating the effectiveness of our existing approaches.

companyName: SUI Group Holdings Ltd.

ticker: SUIG


text: As an externally managed company, the Company relies on our Manager's corporate information technology, accounting and financial reporting platforms, enterprise applications and related systems (our "Information Systems") in connection with the Company's day-to-day operations. Our Manager has adopted a written information security program (the "Written Information Security Policy"), which is designed to address applicable requirements under Regulation S-P and the FTC Safeguards Rule. Consequently, the Company also relies on the processes for assessing, identifying, and managing material risks from cybersecurity threats under the Manager's Written Information Security Policy. The processes include, among other things, maintaining secure digital or physical access to information assets, using manual and automated detection methods for malicious code, due diligence of third-party vendors, and engaging a leading provider of cybersecurity services to assess and manage cybersecurity risk. For third-party service vendors that perform a variety of important functions for our business, we seek to engage reliable, reputable service vendors that maintain cybersecurity programs.

companyName: Advanced Flower Capital Inc.

ticker: AFCG


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our CIO, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Corsair Gaming, Inc.

ticker: CRSR


text: See Item 1A of this Annual Report on Form 10-K for more information of risks relating to cybersecurity, including the risk factors "We Rely on Information Technology Systems, including Third-Party Cloud-based Solutions, and Any Failure of These Systems or Interruption in Services Provided by the Systems May Result in Disruptions or Outages in Our E-Commerce and In-Store Retail Platforms, Loss of Processing Capabilities, and/or Loss of Data, Any of Which May Have a Material Adverse Effect on Our Financial Condition, Results of Operations or Cash Flow" and "A Security Breach of Our or Our Third-Parties' Systems, Exposure of Personal or Confidential Information or Increased Government Regulation Relating to Handling of Personal Data, Could, Among Other Things, Disrupt Our Operations or Cause Us to Incur Substantial Costs or Negatively Affect Our Reputation".

companyName: COLUMBIA SPORTSWEAR CO

ticker: COLM


text: Our VP of Technology and Director of IT, together with our managed service provider ("MSP"), are responsible for helping to identify, assess and manage the Company's cybersecurity threats and risks by monitoring and evaluating our threat environment using, among other things, manual processes, automated tools, internal audits, threat and vulnerability assessments, evaluating threats reported to us, evaluating our and our industry's risk profile, and subscribing to reports and services that identify cybersecurity threats.

companyName: Origin Materials, Inc.

ticker: ORGN


text: Our Board of Directors considers cybersecurity risk a part of its overall risk oversight function. The VP of IT/CISO reports to the CFO & COO, who regularly reports to the Board of Directors and Audit Committee regarding cybersecurity risks and our risk management program.

companyName: Prestige Consumer Healthcare Inc.

ticker: PBH


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to our Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Warby Parker Inc.

ticker: WRBY


text: Our Board is engaged in the oversight of cybersecurity threat risk management. As reflected in the Audit Committee's charter, the Board has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee. The Audit Committee regularly receives updates on cybersecurity risks and the security and operations of our information technology systems from our Chief Financial Officer. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: STRYVE FOODS, INC.


text: Management's Role Managing Risk The Chief Executive Officer and Chief Financial Officer play a pivotal role in serving on the IT Committee, which meets at least twice a year and discusses a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards.

companyName: Community Healthcare Trust Inc

ticker: CHCT


text: The Cybersecurity Plan is part of the Company's corporate Enterprise Risk Management (ERM) program. The Company's ERM program includes an annual review of new or emerging risks (including risks from cybersecurity threats), the assessment of such risks and their potential effects on the Company, the velocity of potential cybersecurity incidents resulting from such risks, and risk mitigation strategies.

companyName: UNITIL CORP

ticker: UTL


text: The Company regularly conducts penetration testing, both internally and by third parties, and conducts automated attacks simulating real-world cyber incidents. These tests and assessments are useful tools for maintaining a comprehensive cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. We continue to expand our cybersecurity risk mitigation strategies, which includes around-the-clock monitoring of our global network, using layered defenses and identifying and protecting critical assets, including our manufacturing facilities. The Information Security team conducts annual cybersecurity awareness training and quarterly email phishing tests and training for all employees.

companyName: OLIN Corp

ticker: OLN


text: Incident Response Plan The Company has implemented an Incident Response Plan (the "IRP") to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data. The Company's business continuity and disaster recovery programs provide a coordinated response when responding to incidents. The IRP is implemented and maintained by the ISO and is subject to annual review and approval by the Board. Cybersecurity metrics are reported to the board monthly.

companyName: CFSB Bancorp, Inc. /MA/

ticker: CFSB


text: The escalation path for cyber incidents is determined by materiality. Minor cyber incidents are addressed immediately by the Cybersecurity Core Team. If the issue requires a cross-functional response, or there is any indication of business interruption, financial harm, data loss, significant system functionality loss, unreasonably delayed service provision or exposure of sensitive data (such as Personal Identifiable Information), the incident is escalated to the Cybersecurity Leadership Team to respond to the threat and perform an initial incident classification. If after further investigation, it is determined the incident could have a material impact on the business, the issue is escalated to the audit committee.

companyName: Snap One Holdings Corp.


text: Depending on the severity and the nature of the incident, an investigation and impact mitigation protocols may be triggered. External experts or agencies may also be engaged in accordance with the Company's policies and procedures. Upon conclusion of the active investigation of an incident, the SOC is required to identify the cause of the incident, formally report to Company leadership, and initiate changes to protect against a recurrence of the incident, among other procedures.

companyName: Aptiv PLC

ticker: APTV


text: Our cybersecurity risk management program includes an incident response plan for evaluation, response and reporting of cybersecurity incidents, including notification of the Board and third parties, as appropriate. Under the plan, a Cybersecurity Intake Team, which is comprised of the Chief Information Officer (CIO), Senior Director of Information Security (SDIS) and other executive management, is responsible for a materiality assessment of cybersecurity incidents, taking into consideration both quantitative and qualitative factors, and subject to ongoing monitoring and escalation based on materiality.

companyName: APOGEE ENTERPRISES, INC.

ticker: APOG


text: The Company has integrated cybersecurity risk management into its broader enterprise risk management ("ERM") through defined training and incident response plans. The incident response plan defines the objectives, roles and responsibilities and scope of our incident response program, is designed to detect actual or potential cybersecurity events and is triggered by Endpoint Detection and Response ("EDR") system behavior monitoring. Once initiated, the incident response plan consists of several phases, which includes i) detecting a significant observable event, ii) examining a security related event with potential negative IT consequences for the company and iii) analyzing the risk of the event and the degree of remediation required. The Company has developed an incident management plan that operates within the incident response plan to help define the objectives, roles, responsibilities, and scope of our incident response plan.

companyName: LIFETIME BRANDS, INC

ticker: LCUT


text: Our management members, specifically our Chief Executive Officer, Chief Financial Officer, President and Chief Operating Officer, Information Security Officer and Chief Compliance Officer, have cybersecurity expertise gained through years of training, internal and external discussions, numerous learning exercises, and development, execution and evaluation of our cybersecurity policies.

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: Our VP of IT oversees information technology ("IT") strategy, operations, cybersecurity, compliance, and business applications. They are dedicated to accelerating and scaling our company by implementing innovative technology across the company. Additionally, they are an accomplished IT executive with over 20 years of leadership experience driving transformative change across diverse industries, including manufacturing, supply chain, and software as a service. The VP of IT is a skilled technical leader proficient in technology strategy, enterprise architecture, and program management.

companyName: Velo3D, Inc.

ticker: VELO


text: The Company uses a number of other internal and external resources to manage its information technology ("IT") and cybersecurity operations across the Company, including global managed service providers that provide 24/7 support for all of the Company's key IT systems and consultants who are engaged periodically to assist with the Company's evaluation of its systems and processes for preventing and mitigating cybersecurity incidents. The Company's global managed service providers also assess cybersecurity incidents and classify them by severity level in accordance with the Company's Incident Response Plan, which determines how each cybersecurity incident is managed and communicated. The Incident Response Plan also outlines the procedures that the Company then follows for evaluation and recovery from an incident, including containment of the affected systems, in order to restore our systems to normal operations. To date, the Company has not had a cybersecurity event that materially impacted its operations, financial position or the security of its proprietary data.

companyName: GRAPHIC PACKAGING HOLDING CO

ticker: GPK


text: The Committee receives periodic updates from management on potential risks, threats, and controls to mitigate identified risks. The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on the cybersecurity risk management program as needed.

companyName: MAYS J W INC

ticker: MAYS


text: The Company is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. Refer to the "Risk Factors" section, which appears in Item 1A of this Report for more information regarding these risks.

companyName: QUAKER CHEMICAL CORP

ticker: KWR


text: If a materiality assessment is required, an assessment committee consisting of the Chief Financial Officer, Chief Operating Officer, Chief Legal Officer, CISO, and Chief Accounting Officer (and/or their designee) (collectively, the "Assessment Committee") will consult with the CSIRT and CSLT, as appropriate. The Assessment Committee is responsible for assessing, without unreasonable delay, the materiality of cybersecurity incidents reported to it, determining materiality and any necessary disclosures, and informing our disclosure committee of such determinations. In assessing materiality, the Assessment Committee will consult with internal and external advisors, as appropriate, and evaluate quantitative and qualitative factors to assess the impact and/or reasonably likely impacts of the cybersecurity incident.

companyName: ADT Inc.

ticker: ADT


text: Company's cybersecurity policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats and responding to cybersecurity incidents are integrated into the Company's risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology. The Company has established controls and procedures, including an Incident Response Plan, that provide for the identification, analysis, notification, escalation, communication, and remediation of data security incidents at appropriate levels so that so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. In particular, the Company's Incident Response Plan (i) is designed to identify and detect information security threats through various mechanisms, such as through security controls and third-party disclosures, and (ii) sets forth a process to (a) analyze any such threats detected within the Company's IT environment or within a third-party's IT environment, (b) contain cybersecurity threats under various circumstances, and (c) better ensure the Company can recover from cybersecurity incidents to a normal state of business operations. The Company has established and maintains other incident response and recovery plans that address the Company's response to a cybersecurity incident.

companyName: Digital Brand Media & Marketing Group, Inc.

ticker: DBMM


text: Controls to mitigate risks, including access controls, data protection, data backups, redundant systems, and incident response plans. We keep our controls up-to-date. Actions to correct deficiencies and reduce or eliminate vulnerabilities. Written cybersecurity contingency plans.

companyName: NVE CORP /NEW/

ticker: NVEC


text: Board and Committee Oversight. Our Board of Directors is responsible for oversight of the Company's cyber risk management program, including risk identification, mitigation strategy and efforts, and resources and receives quarterly updates on cybersecurity risks and mitigation efforts from management, including our Chief Technology Officer (CTO). The Audit Committee of the Board of Directors is responsible for reviewing the Company's financial reporting of cybersecurity risks and incidents in accordance with SEC rules. We will continue to invest in our security infrastructure to ensure it meets or exceeds industry standards for cybersecurity and employs dedicated resources to protect our systems.

companyName: LIQUIDITY SERVICES INC

ticker: LQDT


text: Cybersecurity is a critical part of risk management at IBM and is integrated with the company's overall enterprise risk management framework. The Board of Directors and the Audit Committee of the Board are responsible for overseeing management's execution of cybersecurity risk management and for assessing IBM's approach to risk management. Senior management is responsible for assessing and managing IBM's exposure to cybersecurity risks on an ongoing basis.

companyName: INTERNATIONAL BUSINESS MACHINES CORP

ticker: IBM


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: • a framework for identifying, mitigating and responding to cybersecurity threats and vulnerabilities; • cybersecurity management and support, including team members responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including benchmarking against NIST and FDA standards, and support customer data transfer; • cybersecurity awareness training for employees; • security tools in our system to monitor and detect cybersecurity threats; • cyber liability insurance • a cybersecurity incident response plan that includes how to respond to cybersecurity incidents; and • a third-party risk management process, including contractual obligations, for service providers, suppliers and vendors who have access to our critical systems and information.

companyName: Owlet, Inc.

ticker: OWLT


text: Our Chief Corporate Architect is supported by team members who have relevant educational and industry experience. These team members provide regular reports to the Chief Corporate Architect and work closely with our Chief Privacy Officer and include personnel dedicated to information security, product security, and physical security. Informed by the processes and practices discussed under "Risk Management and Strategy" above, team members escalate cybersecurity threats and incidents to the Chief Corporate Architect, who assesses the severity of such threats and incidents for inclusion in quarterly update to the F&A Committee where appropriate. In addition to the ordinary-course Board of Directors and F&A Committee reporting and oversight described above, we also maintain disclosure controls and procedures designed for prompt reporting to the Board of Directors and timely public disclosure, as appropriate, of material events covered by our risk management framework, including cybersecurity risks.

companyName: ORACLE CORP

ticker: ORCL


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, "Risk Factors— Risks Related to Our Operations—Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."

companyName: Seres Therapeutics, Inc.

ticker: MCRB


text: Management supervises both our internal cybersecurity and IT related personnel, as well as our retained external cybersecurity consultants and vendors. Additionally, they supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefing from internal or external security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants or vendors engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: Limitless X Holdings Inc.

ticker: LIMX


text: We continuously monitor our computing environments, products, and services for vulnerabilities and signs of compromise, and we utilize our own security products to combat cybersecurity threats. We integrate security into our computing environments, products, and services through our Security Development Lifecycle ("SDL"). Our SDL introduces security and privacy considerations throughout all phases of our development process and through the adoption of zero-trust end-to-end architecture. We utilize machine learning and AI-powered security tools to gain insights from 84 trillion signals per day. We track over 1,500 unique threat actors, including more than 600 nation-state actors, 300 cybercriminal groups, 200 influence operation groups, and hundreds of others. To support our efforts, we operate a Cyber Defense Operations Center connected to over 10,000 security and threat intelligence experts, including engineers, researchers, data scientists, cybersecurity experts, threat hunters, geopolitical analysts, investigators, and frontline responders across the globe.

companyName: MICROSOFT CORP

ticker: MSFT


text: The Company's information security program is managed by a dedicated Chief Technology Officer ("CTO"), who has over 25 years of professional experience within information technology roles, including 15 years of security consulting experience. The CTO leads the information technology department, which is responsible for enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Company's Cybersecurity Incident Response Committee (the "CIRC"), which is comprised of the Company's CTO, Chief Financial Officer, General Counsel, Senior Vice President of Financial Reporting and Technical Accounting, and Senior Director of Internal Audit, meets periodically and more often, as needed, in the event cybersecurity incidents are identified.

companyName: MP Materials Corp. / DE

ticker: MP


text: We are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect our company, including our business strategy, results of operations or financial condition. However, we cannot provide assurance that a future cybersecurity incident would not materially affect our business strategy, results of operations or financial condition. Additional information regarding risks related to cybersecurity is included under "Risk Factors" in Part I, Item 1A of this Form 10-K.

companyName: PIPER SANDLER COMPANIES

ticker: PIPR


text: The Director of IT and senior management team provide quarterly reports, or more frequently as necessary, to the audit committee. These reports include updates on the Company's cybersecurity strategy, the status of projects to strengthen the Company's cybersecurity systems, and the emerging threat landscape. The audit committee reports to the Company's board of directors quarterly, or more frequently as necessary, regarding its activities, including those related to cybersecurity.

companyName: RETAIL OPPORTUNITY INVESTMENTS CORP


text: (3) applicable regulatory requirements; and (4) industry standards. The Interim Chief Executive Officer also notifies the Board of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.

companyName: Sonnet BioTherapeutics Holdings, Inc.


text: Our Audit Committee is responsible for the oversight of risks from cybersecurity threats and receives updates from management quarterly. At least annually, the entire Board receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee and Board generally receive materials including a cybersecurity scorecard and other materials indicating current and emerging material cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discuss such matters with our Chief Information Security Officer. Members of the Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.

companyName: Sunrun Inc.

ticker: RUN


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our board of directors and Audit Committee by our CIO, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: UNIVERSAL TECHNICAL INSTITUTE INC

ticker: UTI


text: Our board of directors oversees cybersecurity risk as part of its general risk management responsibilities. Given our limited operations, the board does not currently have a dedicated cybersecurity committee or officer. However, cybersecurity matters are discussed as needed, particularly in the context of potential business combinations or transactions that may introduce new risks.

companyName: RIDGEFIELD ACQUISITION CORP

ticker: RDGA


text: Managing cybersecurity risk is critical to supporting our vision, enabling our strategy, and safely operating our business. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process which covers all Company risks. As part of this process, appropriate personnel collaborate with third-party subject matter experts to gather insights for identifying and assessing material risks associated with cybersecurity threats, their severity, and potential mitigations. Further, we provide periodic training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities and access of the relevant Company personnel. Our policies require all workers to report any real or suspected cybersecurity event. Compare our processes to benchmark standards, such as those set by the National Institute of Standards and Technology ("NIST"). Closely monitor emerging data protection laws and implement changes to our processes as needed. Conduct annual cybersecurity management and incident training for employees involved in our systems that contain sensitive data.

companyName: Eton Pharmaceuticals, Inc.

ticker: ETON


text: Cybersecurity Risks Like other complex corporations, Reliance is the target of cyber-attacks from time to time, which have to date been immaterial individually and in the aggregate to our business strategy, results of operations or financial condition. There can be no assurance that any future cybersecurity incidents will not be material to our business. For additional information about risks related to cybersecurity, please see the risk factor set forth under the caption Item 1A. "Risk Factors" the Risk Factor captioned " We rely on information management systems and any damage, interruption or compromise of our information technology management systems, networks or data could disrupt and harm our business."

companyName: RELIANCE, INC.

ticker: RS


text: Maintaining a robust information security system is an ongoing priority for us and we plan to continue to identify and evaluate new, emerging risks to data protection and cybersecurity both within our Company and through our engagement of third-party service providers like Kroll.

companyName: Century Communities, Inc.

ticker: CCS


text: Cybersecurity is a significant and integrated component of the Company's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Company's information systems. The Company is exposed to cybersecurity threats and incidents that are aimed at gaining unauthorized access to bank systems as a way to misappropriate assets and sensitive information, corrupt and destroy data, or cause operational disruptions. While we have experienced and identified cybersecurity threats, there has been no incident which has had a material effect on the Company's business strategy, results of operations or financial condition.

companyName: CARVER BANCORP INC

ticker: CARV


text: In addition, EOG's internal audit team, in conjunction with third-party experts, plays an important role in reviewing and assessing EOG's cybersecurity technologies, controls and procedures, including conducting penetration testing and vulnerability assessments.

companyName: EOG RESOURCES INC

ticker: EOG


text: We rely on both internal information technology systems and networks, and those of third-party vendors and contractors, to acquire, transmit, store and otherwise process information in connection with our business activities. Our ability to effectively manage our business depends on the security, reliability and adequacy of our and our third-party contractors' and vendors' technology systems. As such, we have implemented an information security program designed to identify, assess, and manage risks from cybersecurity threats.

companyName: Xenon Pharmaceuticals Inc.

ticker: XENE


text: We have a set of company-wide policies and procedures concerning cybersecurity matters that include security risk assessment, identity and access control, vendor security and vulnerability management. There are other policies related to cybersecurity involving employees' use of company equipment and resources, generative AI, remote work and workplace security and safety. These policies are reviewed periodically and approved by appropriate members of management.

companyName: Upstart Holdings, Inc.

ticker: UPST


text: cybersecurity risk management program shall include: risk assessments designed to help identify material cybersecurity risks to our Confidential Information, Critical Systems and the broader enterprise IT environment;

companyName: HeartCore Enterprises, Inc.

ticker: HTCR


text: At Western Digital, our management team is charged with managing risk and bringing to our Board of Directors' attention all material risk exposures to our company. Our enterprise risk management ("ERM") process is designed to facilitate the identification, assessment, management, reporting and monitoring of material risks our company may face over the short-term and long-term and assure regular communication with our Board of Directors and its committees regarding these risks. Through our ERM process, we have determined that the compromise, damage or interruption of our technology infrastructure, information systems or products by cybersecurity incidents is a key risk to our company that may have a material negative impact on our business. To help mitigate the potential impact of cybersecurity incidents on our business and protect against cybersecurity threats, we have established organizational structures, procedural measures and response plans that define roles and responsibilities related to cybersecurity risk management.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: Our head of information security periodically provides briefings to our internal security committee and to the audit committee and board of directors on an annual basis regarding our Company's cybersecurity risks and activities, including, as applicable, any recent cybersecurity incidents and related responses and remediation efforts, cybersecurity systems testing, activities of third parties, policies and the like. We have internal guidelines governing our identification, assessment, communication, and escalation upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to a special executive security committee and the chair of the audit committee, among others as needed, to manage the Company's response.

companyName: QuantumScape Corp

ticker: QS


text: The Audit, Finance and Risk Committee (AFRC) provides primary oversight of cybersecurity matters, including with respect to financial risk and controls, integrity of financial data and public disclosures, and security of the cyber landscape across data and digital. Management provides quarterly cybersecurity reports to the AFRC and the Board and also reports to the Safety and Reliability Committee, as deemed necessary, on cybersecurity issues related to safety, reliability and operations.

companyName: ENBRIDGE INC

ticker: ENB


text: Both EQT and its Adviser remain committed to adopting the highest cybersecurity standards and practices, continuously enhancing their cybersecurity capabilities, and prioritizing the safeguarding of company and customer data from potential threats. In the last fiscal year, EQT and EQRT have not experienced any cybersecurity incidents, that have materially affected us or are reasonably likely to have materially affected our operations, strategy, performance, cash flows or financial health. See Part I, Item 1A, "Risk Factors—Risks Related to Our Organization Structure—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, financial condition and operating results."

companyName: EQT Exeter Real Estate Income Trust, Inc.


text: Our Board oversees cybersecurity risk as part of its overall risk oversight function. Our information technology department (the "IT Department"), which functions as our Information Security Advisory Team, is responsible for managing our information security program and implementing cybersecurity risk management practices. The IT Department is led by our Chief Technology Officer and Chief Information Officer, who oversee our cybersecurity strategy and ensure its alignment with business objectives.

companyName: Hyperscale Data, Inc.

ticker: GPUS


text: Managing cybersecurity risk is critical to Centrus. Centrus expects that the complexity of cybersecurity incidents will continue to evolve. To assess the changing cyber environment, Centrus includes the evaluation of cybersecurity risk as part of its enterprise risk management process and provides periodic reporting to the Board. Assessed risks, whether general or specific to the Company, include operational risk, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy laws and other litigation and legal risk, and reputational risk. This process includes evaluating risks from cybersecurity threats associated with the Company's use of third-party service providers.

companyName: CENTRUS ENERGY CORP

ticker: LEU


text: the review of the security procedures used by third parties that may host or otherwise have access to Fuel Tech's data.

companyName: FUEL TECH, INC.

ticker: FTEK


text: 10 The Procter & Gamble Company The CISO also leads the design and development of the Company's cybersecurity program, relying on functional experts within the central Information Security organization as well as on information security experts within each of the Company's Organizational Units. These embedded experts are responsible for the execution of the Company's overall information security strategy and report security risks in their area of responsibility to their Organization Unit leader and to the CISO. Experts within the Company's central Information Security organization help develop the Company's cybersecurity strategies, policies and standards and similarly report security risks within the central enterprise to the CISO.

companyName: PROCTER & GAMBLE Co

ticker: PG


text: CYBERSECURITY GOVERNANCE Sempra's, SDG&E's and SoCalGas' respective boards of directors consider cybersecurity risk as part of their risk oversight function. The Sempra board of directors has delegated to its SST Committee, which is entirely composed of independent directors under the independence standards established by the NYSE, oversight of cybersecurity and other information and operational technology risks. The SST Committee reports to the Sempra board of directors regarding the Committee's activities, including those related to cybersecurity. The SST Committee receives briefings on cybersecurity topics from Sempra's chief information security officer, internal information security staff or external experts in part for continuing education on topics that impact public companies. The SST Committee as well as the SDG&E and SoCalGas boards of directors oversee management's implementation of our cybersecurity risk management processes and receive regular reports from management on our material cybersecurity risks. In addition, management updates the SST Committee and SDG&E and SoCalGas boards of directors about certain cybersecurity incidents. The SDG&E and SoCalGas boards of directors receive briefings from SDG&E's and SoCalGas' chief information officer and internal information security staff. SDG&E's and SoCalGas' boards of directors also have formed safety committees that, at times, may oversee the matters described above on behalf of those companies' respective boards of directors.

companyName: SEMPRA

ticker: SREA


text: During the year ended December 31, 2024, we did not identify any cybersecurity threats at the Sponsor or the Trust that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.

companyName: Grayscale Bitcoin Trust ETF

ticker: GBTC


text: As part of our cybersecurity process, we engage external auditors and consultants to assess our cybersecurity program and compliance with applicable practices and standards. To identify and manage the material risks of cybersecurity threats to our business, operations and control environments, we have made significant investments in our technology and have implemented policies, programs and controls, with a focus on cybersecurity incident prevention and mitigation. Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed by third-party auditors and consultants, as well as our internal Information Technology and Legal teams, to ensure compliance with applicable practices and standards.

companyName: Chefs' Warehouse, Inc.

ticker: CHEF


text: Our cybersecurity risk management is based on recognized cybersecurity industry frameworks and standards, including those of the National Institute of Standards and Technology ("NIST"), the Center for Internet Security ("CIS"), the Computer Objectives for Information and related Technology ("COBIT"), and the International Organization for Standardization ("ISO"). We use these frameworks, together with information collected from internal assessments, to develop policies for use of our information assets, access to specific intellectual property or technologies, and protection of personal information. We protect these information assets through industry-standard techniques, such as multifactor authentication and malware defenses. We also work with internal stakeholders across the company to integrate foundational cybersecurity principles throughout our organization's operations, including employment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information. Throughout the year, we also regularly train our employees on cybersecurity awareness, confidential information protection and simulated phishing attacks.

companyName: AAON, INC.

ticker: AAON


text: Employee Training for Cybersecurity: Recognizing that human error can often be a cybersecurity vulnerability, we provide comprehensive cybersecurity training to our employees. This training covers essential practices such as recognizing phishing attempts, securing sensitive information, and adhering to our internal cybersecurity policies.

companyName: AIBOTICS, INC.

ticker: AIBT


text: Our cybersecurity risk management process is aligned with our enterprise risk program. We continuously identify, assess, treat, and monitor cybersecurity risks and report those risks on a periodic and as-needed basis to executive management and the Board. We use various sources of information, including internal and external audits, tabletop exercises, threat intelligence, vulnerability scans, penetration tests, customer and employee feedback, and industry benchmarks, to identify and mitigate our cybersecurity risks. We will also engage third-party services, from time-to-time, to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. Additionally, we evaluate trends in the legal and regulatory environment and consider business drivers, emerging threats, and technology changes to identify risks across our people, processes, and technology. We then assess our current controls and capabilities to mitigate those risks and develop action plans to address any identified gaps or weaknesses. Action plans are prioritized and implemented with monitoring of completion and effectiveness against the identified risks. We also monitor our performance and progress against various key indicators and objectives based upon ever-changing risks and provide ongoing updates to relevant stakeholders, including executive management and the Board.

companyName: CSG SYSTEMS INTERNATIONAL INC

ticker: CSGS