text: Our Board, as a whole and as assisted by Board-level Enterprise Risk Committee, has responsibility for the oversight of our cybersecurity risk management framework. Consistent with this approach, our Board and Enterprise Risk Committee maintain oversight of cybersecurity matters through discussions with management, question and answer sessions, and reports from the management team, which generally occur on a quarterly basis and ad hoc as needed. Such reports include updates on any cybersecurity incidents and mitigation efforts. Our Board and our Enterprise Risk Committee also receive regular and ad hoc reports from our management-level enterprise risk committee on all enterprise risks, including risks from cybersecurity threats. Our Audit Committee provides additional oversight on our cybersecurity risk management framework, with an emphasis on public reporting obligations and the effects cybersecurity risks could have on our financial condition generally.

companyName: Beneficient

ticker: BENF


text: • Other Roles – The Cyber Program includes engagement of other Company management employees and outside service providers to oversee or perform specific roles in connection with cybersecurity risk assessment and management, and incident management. That includes risk and security heads from our material business lines who implement and administer policies specific to those business lines and independent auditors to certify compliance with the Company's internal control over financial reporting, the American Institute of Certified Public Accountants' Systems and Organization Controls (SOC 2) security framework, and the Federal Government's Federal Risk and Authorization and Management Program (FedRAMP) criteria for federal use of cloud services. We also conduct reviews for compliance with data protection regulation such as Europe's General Data Protection Regulation (GDPR) and regulation of various U.S. states such as the California Consumer Privacy Act (CCPA). Risk Management and Strategy Overview of Processes for Assessing, Identifying, and Managing Material Cyber Risks.

companyName: MANHATTAN ASSOCIATES INC

ticker: MANH

secItem: Item 1C


text: Training and Awareness Cybersecurity awareness among our employees is promoted with regular training and awareness programs. Employees who access our systems are required to undergo annual cybersecurity training and, each year, employees are required to test their understanding of our cybersecurity policies. Further, our employees that handle PII are required to undergo training, including phishing exercises and awareness programs on the appropriate management, use and protection of that information.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: Cybersecurity threats have the potential to disrupt our day-to-day operations, compromise sensitive data, and damage our reputation. While we have not experienced any material cybersecurity incidents to date, we acknowledge the potential impact of such threats on our business strategy, operations, and financial status. We also maintain cyber liability insurance coverage to help mitigate potential financial losses arising from certain cyber-related incidents, though it may not extend to all significant events. Additionally, regulatory fines or legal liabilities resulting from data breaches or non-compliance with cybersecurity standards will have a significant financial impact.

companyName: Altus Power, Inc.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced cybersecurity threats and other security incidents that have affected our information or systems. We have experienced, and expect to continue to be subject to, cybersecurity threats and incidents, ranging from employee error or misuse to individual attempts to gain unauthorized access to information systems, to sophisticated and targeted measures known as advanced persistent threats, none of which have been material to the Company to date.

companyName: KULICKE & SOFFA INDUSTRIES INC

ticker: KLIC


text: OneMedNet manages cybersecurity and data protection through a continuously evolving framework, as described in further detail below. The framework allows us to identify, assess and mitigate the risks we face, and assists us in establishing policies and safeguards to protect our systems and the information of those we serve. Our cybersecurity program is managed by James Wang, our Chief Technology Officer. James holds a degree in computer science from the University of Hawaii at Manoa and has 19 years of development experience focused on architecture and security. In his career, he has led initiatives for companies to attain SOC2 compliance and PCI compliance for their product solutions.

companyName: OneMedNet Corp

ticker: ONMD


text: Our business operations involve confidential information, including patient health information subject to regulation as discussed under " HIPAA, HITECH and Other Privacy Regulations " above. Our information technology infrastructure is designed to offer reliability, scalability, performance, security and privacy for our personnel, clients, and third-party contractors.

companyName: Electromed, Inc.

ticker: ELMD


text: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including multifactor authentication, firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: Nakamoto Inc.

ticker: NAKA


text: Board Oversight of the Cybersecurity Program and Patient Privacy Matters Our board of directors has actively sought out experience and expertise among its members to further its oversight of cybersecurity risk. We believe that Messrs. Carmichael and Reidy and Ms. Herman have extensive knowledge and experience to support cybersecurity oversight. Mr. Carmichael previously served as chief information officer at multiple companies, and Mr. Reidy directly supervised and oversaw the information security programs at two companies. Ms. Herman has completed the National Association of Corporate Directors' Cyber-Risk Oversight Program, which is designed to enhance cybersecurity literacy and strengthen cyber-risk oversight practices, and holds a CERT Certificate in Cybersecurity Oversight.

companyName: Encompass Health Corp

ticker: EHC


text: The oversight of Bioventus' Cybersecurity Program falls under the purview of the Company's Director of IT Security, Risk and Compliance, who has over 25 years of combined technical and leadership experience, with the past 18 years focused on information security and technology risk management, and holds Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM) certifications.

companyName: Bioventus Inc.

ticker: BVS


text: We have established a continuous monitoring strategy and program, which includes: • a set of defined security metrics to be monitored. • performance of security control assessments on an ongoing basis. • addressing results of analysis and reporting security status to the executive team. • monitoring information systems to detect attacks and indicators of potential attacks. • identification of unauthorized use of the information system resources; and • deployment of monitoring devices strategically within the information system environment.

companyName: ENSIGN GROUP, INC

ticker: ENSG


text: We foster a shared responsibility for the Company's cybersecurity with all our employees, conducting periodic phishing simulation campaigns and providing regular, mandatory security awareness training to enhance awareness and readiness against cyber threats. Certain roles require additional role-based, specialized cybersecurity training. To protect our data and information systems, we maintain Company-wide cybersecurity policies and procedures regarding encryption requirements, malware protection, remote access, multifactor authentication, confidential and privacy information, and internet, social media, email, and wireless device usage. The CISO and IT team review and update such policies and procedures to adapt to evolving cybersecurity landscapes, industry best practices, and regulatory and statutory updates. Our CISO conducts thorough reviews of these updates at least annually to ensure their continued relevance and effectiveness in safeguarding the Company's assets and business interests.

companyName: Maiden Holdings, Ltd.

ticker: MHLA


text: We may utilize various resources that we deem necessary based on actual or potential threats and vulnerabilities to Axos, including engaging independent third-party assessors, consultants and/or auditors to help evaluate the effectiveness of our cybersecurity risk management program, processes, and controls.

companyName: Axos Financial, Inc.

ticker: AX


text: The Trust, through the Sponsor, has established procedures to manage significant cybersecurity risks. The Trust's operations depend on the systems of the Sponsor and other third-party providers. The Sponsor manages the Trust's day-to-day operations and has implemented a cybersecurity program that applies to the Trust and its operations.

companyName: 21Shares Ethereum ETF

ticker: TETH


text: Our information security function, which is led by our Executive Director of Information Technology, with support from our Senior Information Security Manager, our legal team, a management-level Technology Steering Committee, and the Audit Committee of the Board, helps identify, assess, and manage the Company's cybersecurity threats and risks. We identify and assess cybersecurity risks by monitoring and evaluating our threat environment using various methods including, for example using automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating threats reported to us, evaluating our and our industry's risk profile, analyzing reports of threats and actors, audits, conducting vulnerability assessments, and conducting tabletop incident response exercises.

companyName: MACROGENICS INC

ticker: MGNX


text: We review all technology third party vendors and service providers for the following: access management controls including physical safeguards, disaster recovery capabilities, data privacy and notification processes, onboarding processes, and incident response procedures. In addition, we perform periodic independent testing of vendor capabilities and review the annual System and Organization Controls ("SOC") Type 1 and/or SOC II Type 2 reports of all of our third-party vendors hosting our data to ensure they conform to those requirements.

companyName: Meritage Homes CORP

ticker: MTH


text: The cybersecurity program includes an incident response plan with a cross-functional team comprised of designated members of the information technology department, senior management, and other appropriate individuals. The team is responsible for assessing and managing the cybersecurity incident response process, as outlined within the incident response plan, and taking necessary corrective actions to mitigate and eliminate the issue.

companyName: Oil-Dri Corp of America

ticker: ODC


text: The Company sets forth enterprise-wide coordinated responses to identified threats, ensuring timely mitigation and remediation, and facilitating awareness and communication. Tabletop exercises are held regularly at the senior and executive management levels, and annually at the Board of Directors level, to validate roles and responsibilities, and response protocols respective to cybersecurity threats.

companyName: GREENE COUNTY BANCORP INC

ticker: GCBC


text: Our assessment and management of risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program in concert with the audit committee and board of directors; (2) our information security team works with our management team in an effort to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our information security and management team evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee for further communication as required, to evaluate our overall enterprise risk. We use third-party service providers to assist us in identifying potential risks from cybersecurity threats. For example, these service providers include professional services firms, managed cybersecurity service providers, penetration testing firms and forensic investigators. We have a vendor management process designed to manage cybersecurity risks associated with our use of these providers. This process includes risk assessments, security questionnaires, review of vendor security programs, review of available security assessments, reports, and audits.

companyName: AAON, INC.

ticker: AAON


text: ETST recognizes the growing importance of cybersecurity. The company employs a dedicated IT infrastructure department led by Chris Rose. The IT department assumes the primary responsibility for overseeing our cybersecurity risk exposure across the entire organization. This includes evaluating, assessing, and enhancing cybersecurity practices.

companyName: Earth Science Tech, Inc.

ticker: ETST


text: Our IT systems and digital technology has been an important part of our operations and our ability to compete successfully. We continue to invest in technology solutions to improve inefficient systems, to streamline and automate workflows and to provide digital and mobile applications for our field service personnel. We are committed to maintaining robust cybersecurity measures, continuously evaluating and updating our cybersecurity practices, and being prepared to respond to and recover from cybersecurity incidents. We face ongoing risk from cybersecurity threats. There can be no assurance that our efforts will prevent or mitigate all cybersecurity events, which, if realized, could have a material impact on our operations and financial results. See Part I, Item 1A "Risk Factors" of this Report for additional information.

companyName: NATURAL GAS SERVICES GROUP INC

ticker: NGS


text: Our officers, contractors and third-party IT vendors help assess, identify and manage our cybersecurity threats and risks by monitoring and evaluating our threat environment and risk profile using various methods including, for example: through the use of automated tools; conducting audits and threat assessments for internal and external threats;

companyName: TherapeuticsMD, Inc.

ticker: TXMD


text: As of the end of fiscal year 2025, we have not identified any risks from known cybersecurity threats (including as a result of any prior cybersecurity incidents) that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions. While our cybersecurity risk management strategy is intended to assess, identify and manage material risks from cybersecurity threats, it may not adequately do so in every instance, particularly given the evolving nature of the cybersecurity threat landscape. We expect that our policies and processes will continue to be subject to update as the risks from cybersecurity threats change. For more information about risks from cybersecurity threats, and whether they are reasonably likely to materially affect our business strategy, results of operations or financial conditions, please see the Risk factors discussion in Item 1A of this Form 10-K, including "Risks related to system security, cyber-attacks and data breaches".

companyName: CIRRUS LOGIC, INC.

ticker: CRUS


text: To protect the information that we gather and the availability of our IT systems from cybersecurity threats, we have an ongoing cybersecurity risk mitigation program, which includes maintaining up-to-date detection, prevention and monitoring systems and contracting with outside cybersecurity firms to provide constant monitoring of our systems. A cybersecurity threat is any potential unauthorized occurrence on or conducted through our information systems or the information systems of a third party that we utilize in our business which may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein. Our cybersecurity policies, standards, processes and practices are based on the Center for Internet Security Critical Security Controls and include the following components:

companyName: POTBELLY CORP

ticker: PBPB


text: We have implemented and continue to maintain the Company's IT policies, standards, procedures, and controls to oversee, identify and manage cybersecurity risks associated with all third-party service providers. These include, but are not limited to, an IT acceptable use policy, a records and information management policy, change control procedures, risk and control registry, attestation report reviews, and configuration standards.

companyName: Texas Pacific Land Corp

ticker: TPL


text: The Bank's board of directors are responsible for overseeing Peapack Private's information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The Bank's Information Security Officer, Chief Information Officer, and Chief Technology Officer provide reports to the Bank's board of directors regarding the information security program, technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The board of directors reviews and approves our information security program, technology budgets, and strategies annually.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: One of the key functions of our Board is to be informed oversight of our risk management process, including risks from cybersecurity threats.

companyName: PetVivo Holdings, Inc.

ticker: PETV


text: Our cybersecurity program incorporates industry-standard frameworks (including third-party certification), policies, and practices designed to protect the privacy and security of our sensitive information. Our third-party certifications for certain Solutions include a HITRUST Common Security Framework certification (which includes standards from frameworks such as HIPAA, ISO, EU, GDPR, NIST, and PCI to provide risk-based certification for companies in the healthcare supply chain) and a Statement on Standards for Attestation Engagements 18 (SSAE 18) System and Organization Control (SOC) 2 report that evaluates our security program.

companyName: Health Catalyst, Inc.

ticker: HCAT


text: Our Chief Information Officer oversees our Information Technology Team and is responsible for the development and implementation of strategy for our information systems, networks, infrastructure, cybersecurity and data analytics. She has more than 25 years of experience in the field of information technology and is a member of our senior leadership team. Prior to joining Ventas, she spent approximately 12 years at a multinational hospitality public company where, in her most recent role, she was responsible for application management and support of enterprise-wide systems. This role also had responsibility for global service desk support for more than 100,000 employees.

companyName: Ventas, Inc.

ticker: VTR


text: We take cybersecurity seriously and have developed a cybersecurity program that consists of processes, policies, and controls for assessing, identifying, managing, and responding to material risks from these threats. Our cybersecurity program is integrated within our broader risk management function that identifies, monitors, and mitigates business, operational, financial, and legal risks.

companyName: Intrepid Potash, Inc.

ticker: IPI


text: We incorporate external expertise and reviews as part of our cybersecurity program. For example, we have engaged an independent cybersecurity advisor to review, assess, and make recommendations regarding our information security program and information technology strategic plan. We recognize that third-party service providers introduce cybersecurity risks. In an effort to mitigate these risks, before engaging with any third-party service provider, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to include cybersecurity requirements in our contracts with these providers and endeavor to require them to adhere to security standards and protocols. Further, we request that third-party service providers with access to personally identifiable information enter into data processing services agreements and adhere to our policies and standards.

companyName: OneWater Marine Inc.

ticker: ONEW


text: Our cybersecurity risk management processes are integrated into our overall enterprise risk management system. Our Board of Directors (the "Board") understands the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to provide effective oversight of risks associated with cybersecurity.

companyName: Victoria's Secret & Co.

ticker: VSCO


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means and indicators, which may include, but are not limited to, alerts from customers, employees, vendors, service providers, other third parties, and/or automated event-detection notifications. Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response coordinator follows the procedures pursuant to the CSIRP to investigate the potential incident, including classifying the nature and severity of the event (e.g. malware, ransomware, service interruption, denial of service, distributed denial of service, personal data breach, intellectual property breach, theft, or fraud) and sensitivity of any compromised data.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: We have not identified any specific risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section "Item 1A. Risk Factor—Risks Related to Healthcare Laws and Other Legal Compliance Matters—Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."

companyName: Mereo BioPharma Group plc

ticker: MREO


text: Our cybersecurity risk management is an important part of our comprehensive business continuity program and enterprise risk management. Our global information security team periodically engages with a cross-functional group of subject matter experts and leaders to assess and refine our cybersecurity risk posture and preparedness. For example, we regularly evaluate and update contingency strategies for our business in the event that a portion of our information resources were to be unavailable due to a cybersecurity incident. We practice our response to potential cybersecurity incidents through regular tabletop exercises, threat hunting and red team exercises.

companyName: Zedge, Inc.

ticker: ZDGE


text: The Company's Enterprise Risk Management Committee provides the Board with an overview of cybersecurity risks regularly. Additionally, the Company's Chief Executive Officer ("CEO") provides the Board with an Information Security Incident Report for Board meetings, which summarizes new incidents that did not require "off-cycle" escalation to the Board, and status updates on previously reported high severity incidents, as well as a cybersecurity incident analysis report issued by a third-party cybersecurity service provider.

companyName: MERCURY GENERAL CORP

ticker: MCY


text: The Director of Technology and Innovation's presentation at the Company's monthly senior leadership meeting, led by the CEO, includes the results of the most recent scans and routine testing. Should a cybersecurity incident occur, the Director of Technology and Innovation is required to immediately report it to the CEO, who is required to report any material cybersecurity breach promptly to the Company's Board of Directors.

companyName: Good Times Restaurants Inc.

ticker: GTIM


text: The full Board of Directors engages in oversight of TDS' cybersecurity risks. The Board of Directors receives regular updates from management on technology and security updates and TDS' assessment of cybersecurity threats and mitigation plans. The TDS CISO and UScellular Senior Vice President of Information Technology provide the full Board of Directors an annual update and discussion of the cybersecurity program. The TDS Audit Committee oversees the processes over internal controls and financial reporting that includes controls and procedures that are designed to ensure that significant cybersecurity incidents are communicated to both senior management and the Audit Committee. The Audit Committee meets with the TDS CISO and UScellular Senior Vice President of Information Technology at least two times per year. Cybersecurity is also discussed with the Technology Advisory Group of the Board of Directors as warranted, typically on an annual basis.

companyName: TELEPHONE & DATA SYSTEMS INC /DE/

ticker: TDS


text: Despite taking extensive precautions, cybersecurity incidents are still possible. In general, when our cybersecurity team detects a cybersecurity threat by way of an alert within our cyber defense systems, employee notice, or otherwise, our IT Director, Cyber Security, along with other relevant personnel, is promptly apprised of the situation, and actively takes steps to prevent, mitigate, or remediate that threat. If a cybersecurity threat appears to progress into a possible cybersecurity incident, our IT Director, Cyber Security serves as the CIMT's incident manager and the CDO or designee notifies the Chief Risk Officer of a need to activate the CIMT as appropriate, informs and updates the CIMT and may consult other internal and external resources with the required technical, application, organizational and business knowledge to provide effective advice to the CIMT.

companyName: BWX Technologies, Inc.

ticker: BWXT


text: Enbridge's management is responsible for the implementation of risk management strategies and monitoring performance. The technology and information services (TIS) function is centralized under the Senior Vice President & Chief Information Officer (CIO), who has over two decades of international leadership in the business of technology. We also engage independent third parties to assess our cybersecurity program, track their recommendations and use those to further improve the program. Reporting to the CIO is the Chief Information Security Officer who is in charge of our cybersecurity program and oversees the 24x7x365 Security Operations Center (SOC).

companyName: ENBRIDGE INC

ticker: ENB


text: Our IT department collaborates with our Chief Operating Officer to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have processes to detect potential vulnerabilities and anomalies through technical safeguards. As part of our risk management process, we conduct regular IT security audits to assess and respond to internal and external security threats.

companyName: Acumen Pharmaceuticals, Inc.

ticker: ABOS


text: As part of its role as independent oversight of the key risks facing Nexstar, the Board itself and through its Audit Committee devotes regular and thorough attention to our cybersecurity risk. The Audit Committee receives quarterly (or more frequent as necessary) reports from senior financial executives and Nexstar's Chief Technology and Digital Officer to evaluate cybersecurity and data risks. Such reporting includes updates on the Company's cybersecurity program, the external threat environment, and the Company's programs to address and mitigate the risks associated with the evolving cybersecurity threat landscape. In accordance with our Cyber Incident Response Plan, the Audit Committee is promptly informed of any cybersecurity incidents that could potentially materially adversely affect the Company or its information systems and is regularly updated about incidents with lesser impact potential. The Audit Committee and management regularly brief the full Board on these matters as well.

companyName: NEXSTAR MEDIA GROUP, INC.

ticker: NXST


text: The underlying controls of the cyber risk management program are designed to meet Oaktree's business requirements, security risks and organization profile, and leverages many elements of the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization Standardization ("ISO") 27001 Information Security Management System Requirements. The Internal Audit team conducts an annual internal audit of the Company's cyber risk management program utilizing the services of a third-party provider. Additionally, Oaktree hires a third party provider to conduct an annual penetration test of Oaktree's systems. Oaktree has developed and implemented controls and processes to oversee and manage its engagements with third-party vendors. These procedures encompass pre-engagement due diligence efforts and the ongoing monitoring of the third-party vendors that are considered to be high-risk. Although these controls and processes are designed to mitigate risks associated with third-party engagements, they do not guarantee the elimination of all potential risks. The effectiveness of these controls and processes is dependent on a variety of factors, some of which are outside our control.

companyName: Brookfield Oaktree Holdings, LLC

ticker: OAK-PA


text: For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.

companyName: Dare Bioscience, Inc.

ticker: DARE


text: We believe our systems and processes with respect to the management of risks associated with cybersecurity threats are adequate. We have experienced, and may in the future experience, adverse impacts to our operations as a result of cybersecurity incidents. However, to date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see our risk factors, including our risk factor titled "If our internal enterprise IT networks, on which we conduct internal business and interface externally, our operational networks, through which we connect to customers, vendors and partners systems and provide services, or our research and development networks, our back-end labs and cloud stacks hosted in our data centers, colocation vendors or public cloud providers, through which we research, develop and host products and services, are compromised, public perception of our products and services may be harmed, our customers may be breached and harmed, we may become subject to liability, and our business, operating results and stock price may be adversely impacted."

companyName: Fortinet, Inc.

ticker: FTNT


text: We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management process in accordance with our risk profile and business that is informed by industry standards and is integrated into our enterprise risk management process.

companyName: Korro Bio, Inc.

ticker: KRRO


text: We have developed and implemented a cybersecurity governance program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Gossamer Bio, Inc.

ticker: GOSS


text: During a critical cybersecurity event, our Incident Response Team will coordinate with designees from our Disclosure Committee to ensure key details regarding event impact on data, operations, and financials and other attributes of the event are properly communicated. Upon resolution of the event, our IT leadership will compile and retain evidence regarding the event and evaluate it to determine the materiality of the event. In this process, our IT team will provide an overview of the timeline, nature, and severity of impact and highlight the attributes that would aid in the determination of materiality. Our Disclosure Committee is responsible for identifying and communicating with interested parties relative to such an event.

companyName: Centuri Holdings, Inc.

ticker: CTRI


text: Cyber Risk Management Personnel The IT Manager directly reports to senior management. The IT Manager regularly meets with senior management to update and discuss any cybersecurity risks and incidents affecting the Company. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, all significant cybersecurity matters and strategic risk management decisions are promptly escalated to the Board of Directors, ensuring that they have an up-to-date, comprehensive understanding of and can provide guidance on critical cybersecurity issues.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: Our cybersecurity risk management program includes: • overall risk assessment; • a technology team leveraging a third-party Security Operations Center (SOC) partner to monitor, manage and respond to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees and regular phishing campaigns; • a cybersecurity incident response policy that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.

companyName: CARGO Therapeutics, Inc.


text: Overseeing Third-party Risk We have implemented processes to oversee and manage risks from cybersecurity threats associated with third-party service providers. We conduct security requirements assessments of third-party providers before engagement and maintain ongoing monitoring for compliance with our cybersecurity requirements. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: ZimVie Inc.


text: The primary means by which the Risk Department evaluates cybersecurity risk is the development, in conjunction with the information security team, of risk metrics related to cybersecurity as well as risk tolerances with respect to each such metric. Risk tolerances are set such that the overall cybersecurity risk presented to us is consistent with the risk appetite statement adopted by our Board annually. Management believes these metrics provide a holistic picture of the Company's cybersecurity risk profile, but at the same time, we recognize that, given the continual evolution of cybersecurity risks, including the tools and vectors that bad actors take to compromise a company's information security, our risk metrics cannot remain static. At least annually, the Risk Department meets with the CISO to assess whether the risk metrics, and the tolerances for each metric, remain appropriate in light of the Company's operations and the cybersecurity threat environment.

companyName: RENASANT CORP

ticker: RNST


text: Matson's information security, Internal Audit and risk management teams help to identify and assess cyber and information security threats and vulnerabilities, and establish the appropriate business systems, preventive controls and risk mitigation strategies. The main objectives of Matson's approach to cyber and information security are to protect confidential information while maintaining data integrity and availability; support legal and regulatory compliance; and prevent disruptions to business operations. The Company regularly enhances its systems, controls and strategies in an effort to guard against security breaches and unauthorized access to Matson systems or data and develops policies to guide the appropriate handling and protection of sensitive information by Matson. This includes managing third party supply chain risks with its key vendors and business partners. It also maintains incident response and remediation plans which provide that cybersecurity incidents be communicated to the Company's senior leaders who are responsible for assessing the risks associated with a cybersecurity incident and initiating the Company's incident response plan. The Company's incident response and remediation plans are further supported by ongoing security monitoring services as well as a dedicated management team focused on business continuity to help support operations and mitigate disruptions should a breach, unauthorized access or other disruption event occur. In addition, the Company has established a zero trust network access roadmap that includes key security controls designed to help protect Matson employees and contractors with access to Matson systems against phishing and brute force password attacks.

companyName: Matson, Inc.

ticker: MATX


text: Even with our current control processes and a continuous improvement mindset, cybersecurity threats constantly evolve. If the measures we have employed were to fail, or if a breach were to occur, it could result in impairment or loss of critical functions, such as the operation of our e-commerce websites, our Evansville distribution center, our corporate network and/or our point-of-sale systems, as examples. Additionally, confidential information could be compromised or we could be defrauded or ransomed for a material amount of funds. Any of these outcomes could negatively affect our reputation and customer loyalty. The ultimate effects of a breach or loss in function or confidential information are difficult to quantify with any certainty, but such loss may be partially limited through insurance. See "Risk Factors—We could be adversely affected if our inventory technology systems fail to operate effectively, are disrupted or are compromised", "—Various risks associated with our e-commerce platform may adversely affect our business and results of operations" and "—We outsource certain business processes to third-party vendors and have certain business relationships that subject us to risks, including disruptions to our business and increased costs" in PART I, ITEM 1A of this Annual Report on Form 10-K, which risk factors are incorporated by reference into this section of this Annual Report on Form 10-K.

companyName: SHOE CARNIVAL INC

ticker: SCVL


text: The Company has established an enterprise-wide cybersecurity program designed to prevent disruption to critical information systems, minimize the loss or manipulation of sensitive information, and to timely identify, escalate and promptly remediate and recover from cybersecurity incidents and facilitate compliance with regulatory and disclosure requirements. To oversee cybersecurity risk management, the Company employs a dedicated unit, led by the Company's Chief Information Security Officer ("CISO"), to implement cybersecurity controls, assess and report on cybersecurity risks and consult with the Company's internal Enterprise Risk Management Committee, a decision-making body which supports and oversees the identification, assessment, prioritization, and mitigation strategies for enterprise-level risks, including cybersecurity risks. The CISO has over 25 years of work experience in the information technology, physical security and cybersecurity fields, including previously serving as the Company's Chief Security Officer, and holds the Certified Protection Professional, Professional Certified Investigator and Physical Security Professional certifications from ASIS International. The CISO serves on the Water Sector Coordinating Council ("WSCC"), an advisory body comprised of representatives from various U.S. water and wastewater organizations, which serves as a policy, strategy and coordination mechanism for the water sector on critical infrastructure security and resilience issues. In that role, the CISO partners with representatives from the Department of Homeland Security and the EPA on U.S. water and wastewater sector initiatives. The CISO is also the former Chair of the WSCC, the National Association of Water Companies' Safety and Security Committee, and the ASIS Utility Security Council. The CISO reports directly to the Company's Chief Technology and Information Officer, who is responsible for the Company's information technology program.

companyName: American Water Works Company, Inc.

ticker: AWK


text: cybersecurity risk management program includes the following: use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls;

companyName: NEXGEL, INC.

ticker: NXGL


text: Cybersecurity Risks Although cybersecurity risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we are subject to various cybersecurity risks, which could, in the future, be material. For more information about the cybersecurity risks we face, see risk factor entitled "Our business and operations may be materially adversely affected in the event of computer system failures or security breaches" in Item 1A, "Risk Factors."

companyName: Biohaven Ltd.

ticker: BHVN


text: We maintain a cybersecurity program that includes physical, administrative, and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent, detect and timely and effectively respond to, and as necessary, recover from, cybersecurity incidents. Through our cybersecurity risk management program, we have established operational processes to address issues including monitoring and patching of vulnerabilities, regularly updating our information systems, and evaluating new countermeasures made to defend against an evolving landscape of threats. This process is overseen by the Audit Committee of our Board.

companyName: Cushman & Wakefield Ltd.

ticker: CWK


text: Cybersecurity Risk Oversight The BancPlus board of directors, through the Risk Committee, provides direction and oversight of the enterprise-wide risk management framework of BancPlus. The Risk Committee of the BancPlus board of directors oversees the Company's cybersecurity program. They receive regular reports from the Cybersecurity Committee about the prevention, detection, mitigation, and remediation of cybersecurity risks, including cybersecurity incidents, information security vulnerabilities, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents. BancPlus' risk management framework is overseen by the Chief Risk Officer at the management level. BancPlus' CISO has primary responsibility for assessing and managing material cybersecurity risks and leads management's Cybersecurity Committee. The CISO's experience spans over 20 years of cybersecurity operations and management, leading teams in highly regulated industries such as financial services, healthcare, education, and cybersecurity consulting for private and public companies. The CISO holds a Master of Business Administration and has attained a variety of professional certifications such as CISSP, CISM, GLAW, and GSEC, among others. The CISO reports to the Chief Risk Officer. See the section entitled "Business—Enterprise Risk Management" in Part I, Item 1 of this Annual Report on Form 10-K for additional information on the role of the BancPlus board of directors and its committees in overseeing risk management.

companyName: BANCPLUS CORP


text: Finally, management has instituted our Information Security Council and Enterprise Risk Management Council both of which are made up of senior leaders of the Company. The Information Security Council is tasked with overseeing information security matters at Edwards, including cybersecurity. This council serves as an escalation point for issues requiring concerted action, and in turn, informs executive management regarding information security and cybersecurity risks and issues. The Enterprise Risk Management Council is tasked with proactive management of our enterprise-wide risks, including information security risks that also include cybersecurity. This council is responsible for assessing and providing input into the enterprise risks that are presented to the Board of Directors.

companyName: Edwards Lifesciences Corp

ticker: EW


text: The Board provides active oversight of cybersecurity threats in accordance with the Board-approved Information and Cyber Security Policy and Program. These policies and programs aim to achieve a controlled risk environment while meeting regulatory, legislative, and compliance requirements, including but not limited to the Gramm-Leach-Bliley Act (GLBA), Health Insurance Portability and Accountability Act (HIPAA), Information Technology Sarbanes-Oxley Act (IT SOX) Compliance, and Payment Card Industry Data Security Standard (PCI-DSS) Compliance.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: As discussed in more detail under the heading "Governance," The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with executive leadership, the Company's ERM function, and the Company's Vice President of Information Technology.

companyName: DOUGLAS DYNAMICS, INC

ticker: PLOW


text: We design and assess our cybersecurity program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Unity Biotechnology, Inc.


text: The Corporation's cybersecurity program includes multi-layered technological capabilities designed to prevent and detect cybersecurity disruptions and leverages industry standard frameworks, including the National Institute of Standards and Technology Cybersecurity Framework. The cybersecurity program incorporates an incident response plan to engage cross-functionally across the Corporation and report cybersecurity incidents to appropriate levels of management, including senior management, and the Audit Committee or Board of Directors, based on potential impact. The Corporation conducts annual cybersecurity awareness training and routinely tests cybersecurity awareness and business preparedness for response and recovery, which are developed based on real-world threats. In addition, the Corporation exchanges threat information with governmental and industry groups and proactively engages independent, third-party cybersecurity experts to test, evaluate and recommend improvements on the effectiveness and resiliency of its cybersecurity program through penetration testing, breach assessments, regular cybersecurity incident drill testing, threat information sharing, and industry benchmarking. The Corporation takes a risk-based approach with respect to its third-party service providers, tailoring processes according to the nature and sensitivity of the data or systems accessed by such third-party service providers and performing additional risk screenings and procedures, as appropriate.

companyName: EXXON MOBIL CORP

ticker: XOM


text: As part of our information security program, we have adopted an Information Security Incident Response Plan (Incident Response Plan), which is administered by the Company's Chief Information Security Officer (CISO). The Incident Response Plan describes the Company's processes, procedures, and responsibilities for responding to incidents including security and cybersecurity. The Incident Response Plan is intended to be followed in the event of a cybersecurity incident, including implementation of (i) forensic and containment, eradication, and remediation actions by information technology and security personnel and (ii) operational response actions by business units, communications, legal, and risk personnel. The Incident Response Plan includes an annual tabletop exercise to simulate responses to cybersecurity events. If applicable, each exercise may result in postmortem and discuss lessons learned to evaluate any improvements to the Incident Response Plan. The Incident Response Plan includes processes for escalation and reporting of cybersecurity incidents to the Incident Response Team.

companyName: FIRST BANCSHARES INC /MS/


text: We require employees and temporary staffing to complete annual training on information security, including cybersecurity, global data privacy requirements and compliance measures.

companyName: FIVE BELOW, INC

ticker: FIVE


text: How Senior Management is Informed of and Monitors Incidents Certain members of our senior management team are responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risks are monitored, implementing appropriate mitigation measures and maintaining our cybersecurity program. Our cybersecurity program is under the direction of our VP of Technology (in coordination with certain members of our senior management team), who receives reports from our information technology team and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Certain members of our senior management team are notified as appropriate when the information technology team identifies an emerging risk or material issue.

companyName: Greenbacker Renewable Energy Co LLC


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. See "Item 1A. Risk Factors" for additional discussion regarding the risks we face from cybersecurity threats.

companyName: Opendoor Technologies Inc.

ticker: OPEN


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Revolution Medicines, Inc.

ticker: RVMD


text: The Company's cybersecurity risk management program includes an incident response plan, which provides a documented framework to support the timely and effective resolution of actual or attempted cybersecurity incidents. Cybersecurity incidents across the Company, and relevant third-party service providers, are tracked and significant incidents, as applicable, are promptly escalated to a cross-functional cybersecurity task force so that decisions regarding public disclosure can be made in a timely manner by management and the Board of Directors.

companyName: FEDERAL SIGNAL CORP /DE/

ticker: FSS


text: Recognizing the importance of human factors in cybersecurity, we prioritize conducting regular security and awareness training for employees that emphasizes common threats, such as phishing, social engineering, sensitive data exposure, and insider risks. These initiatives are designed to ensure that employees understand the latest security threats, best practices, and how to recognize potential risks. In addition to regular training sessions, we also perform simulated exercises, such as phishing drills, to reinforce learning and test employees' ability to respond to real-world threats. Lastly, we regularly share security updates and reminders through internal communications and provide dedicated means for employees to report attempted threats.

companyName: ARGAN INC

ticker: AGX


text: Our Enterprise Risk Management Committee, led by our Assurance and Risk Advisory Services group, Chief Financial Officer, and Chief Administrative Officer, collaborates with our executive leadership team and senior-level staff, including the Chief Compliance Officer and the CISO, to evaluate and oversee our primary enterprise risks, including cybersecurity. The CISO provides periodic updates to the board of directors, ensuring that comprehensive risk reviews are conducted and that our cyber risk assessment, practices, and policies are thoroughly discussed with management. Additionally, our Assurance and Risk Advisory Services group delivers periodic updates to the Audit and Finance committee of the board of directors covering financial and enterprise risks, including cybersecurity.

companyName: DELUXE CORP

ticker: DLX


text: The Board of Directors, through its Audit Committee, is responsible for the oversight of Inotiv's cybersecurity risk management practices. The Audit Committee reviews and assesses our approach to risk management, including risk associated with cybersecurity, against industry standards and regulatory obligations. We believe this governance structure is integral to maintaining high-level visibility and accountability across all levels of leadership. By providing the Board of Directors with regular and detailed updates on cybersecurity initiatives and significant developments in the threat landscape, we foster transparency and maintain cybersecurity as a central priority within the organization.

companyName: Inotiv, Inc.

ticker: NOTV


text: The Chief Information Security Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Chief Information Security Officer is also responsible for approving budgets, helping to prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Confluent, Inc.

ticker: CFLT


text: Prioritize suppliers based on their risk profile and level of exposure; and Ensure that third-party engagements align with our corporate, regulatory, and contractual obligations. Together, these measures strengthen our organizational cyber resilience, regulatory preparedness, and long-term operational integrity.

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: The Board of Directors is kept apprised of material risks from cybersecurity threats through the Audit Committee. The Audit Committee is responsible for overseeing threats to the Company, including those involving cyber threats, and reviewing the Company's protocols and procedures to mitigate those threats. On a quarterly basis, the VP, Chief Privacy Officer, presents to the Audit Committee on the Company's cybersecurity compliance and risk management practices. These presentations address, among other things, the results of audits and reviews of our security information systems and other cybersecurity measures, the current threat environment and cybersecurity trends and best practices. As applicable, these quarterly presentations also include reports of cybersecurity incidents affecting our information systems along with updates on the status of prior cybersecurity incidents and applicable remediation efforts. The Audit Committee discusses the adequacy and efficacy of the controls and shares the information with the Board as part of its risk oversight function. Outside of quarterly presentations, the Audit Committee is informed of incidents that in senior leadership's discretion require more immediate Audit Committee attention.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO


text: Cybersecurity is an important part of our Board's risk management focus. Regular reporting on the results and status of our ERM function, as well as our information security program, is provided to our senior management, including the ELT and the Board.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: The ISO, along with the Bank's Third-Party Oversight Committee, evaluates cybersecurity risks and information systems of third parties whose information systems support important Company operations or with whom the Company has significant business relationships at onboarding, on an ongoing basis and upon termination of the business relationship. Such evaluations may include reviews of reports or performing assessments of a third party's information systems pursuant to established cybersecurity frameworks such as International Organization for Standardization (ISO) ISO 27001 or Cybersecurity Framework (CSF) published by the US National Institute of Standards and Technology, as well as reviews of reports issued by a third party's auditors developed under the attestation standards issued by the American Institute of Certified Public Accountants (AICPA). When appropriate, the Company may include additional risk mitigation measures in its onboarding requirements for third parties to address any identified risk factors, such as minimum required information security performance agreements to enable cybersecurity threats and incidents to be managed within applicable industry or regulatory standards, disclosure obligations requiring reporting to the Company of the occurrence and mitigation of cybersecurity threats and incidents, and requirements to maintain adequate levels of cybersecurity insurance coverage.

companyName: Finwise Bancorp

ticker: FINW


text: As part of our overall cybersecurity risk management process, employees receive annual training on incident preparedness, response, and recovery which we believe to be commensurate with their responsibilities. Employees are given directions on where to report actual or suspected incidents, both with respect to cybersecurity incidents as well as other risks, such as office closures, robbery, physical security, and employee or client injury. In addition to employees, individuals with a leadership role in the cybersecurity incident response processes are trained on their responsibilities annually, and the processes and those responsible for implementing them will be tested at least annually to assist in improving performance of the incident handlers and to identify issues with policies, procedures, and communication process.

companyName: FIRST INTERSTATE BANCSYSTEM INC

ticker: FIBK


text: Collaborative Approach: We have implemented a cross-functional approach involving all employees to help in identifying, preventing, and mitigating cybersecurity threats and incidents. We have implemented processes that provide for the prompt escalation of known cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by our management team, together with the Audit Committee, in a timely manner.

companyName: Vir Biotechnology, Inc.

ticker: VIR


text: The ISGC was established by the Audit Committee and its primary responsibility is to provide oversight to the Information Systems Security Program ("ISSP") to align information systems security activities to business goals, effectively manage risk, and ensure compliance. The ISGC is chaired by the Director, IT Risk Management, with the Chief Information Officer as an alternate. The ISGC's responsibilities include developing policies and supporting frameworks, controls, and procedures to protect company, customer, and employee data from cybersecurity breaches; establishing organizational risk tolerance and developing information security policies to align with this tolerance level; and ensuring adequate security controls, as specified in policies or otherwise agreed upon, to manage risk and compliance. The ISGC has developed an ISSP scorecard to communicate cybersecurity incidents and activity and report program accomplishments and provides quarterly updates to the Audit Committee, including the ISSP scorecard, and at least annual updates to the Company's extended leadership team.

companyName: U.S. SILICA HOLDINGS, INC.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations or reports on cybersecurity topics from our SVP Global Technology & Systems, who is our Chief Information Security Officer (CISO), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: BIO-RAD LABORATORIES, INC.

ticker: BIO


text: Our cybersecurity risk assessment and management processes are implemented and maintained by the CISO and the information security team. The CISO is responsible for cybersecurity staffing and maintaining an up-to-date cybersecurity policy and processes framework designed to promote a strong cybersecurity posture, drive security awareness, and facilitate a coordinated response to cybersecurity incidents. The IT Risk Committee, which is chaired by the Chief Information Officer (CIO) and includes the CISO, Chief Risk and Compliance Officer (CRCO) and other executive leadership team members, reviews cybersecurity risks and initiatives on a periodic basis. In addition to their decades of experience and qualifications in finance and management, our CIO holds a Bachelor's Degree in Computer Engineering and Master's Degree in Computer Science, our CISO holds a Bachelor's Degree in Electronics Engineering and has completed industry certifications including Certified Information Security Auditor, Certified Information Systems Security Professional, and ISO 27001 Lead Auditor, and our CRCO has received training in financial services cybersecurity risk management for legal professionals. In addition, all Ocwen executives, along with employees generally, are required to refresh their cybersecurity and IT threat-recognition training annually or more frequently if circumstances warrant.

companyName: ONITY GROUP INC.

ticker: ONIT


text: We have established and maintain business continuity and technical recovery plans of critical systems and resources in the event of a cybersecurity incident that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. We also maintain a cybersecurity insurance policy, though the costs related to cybersecurity threats or disruptions may not be fully insured.

companyName: Shockwave Medical, Inc.


text: More significant cybersecurity incidents or threats may result in notifications to senior leadership and, if necessary, to the Audit Committee and the Board of Directors. Additionally, a cybersecurity governance briefing takes place quarterly with leaders from the Company's technology, operations, commercial, legal, and accounting departments to discuss cybersecurity risks, threats, and incidents, including updates from the SOC and an assessment of ways to mitigate and remediate any threats or incidents the Company may be facing.

companyName: CSX CORP

ticker: CSX


text: The Company relies on Ashford Inc. and the Company's managers to protect the electronic assets of the Company. Their programs consist of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, electronic communication, risk/security reporting, incident response planning and business continuity planning. The information technology department of Remington Hospitality ("IT Department"), which includes a cybersecurity department ("IT Security Department"), is responsible for implementing processes and coordinating with the Human Resources Department to align training and onboarding efforts of Ashford Inc. and Remington Hospitality employees handling the Company's electronic assets.

companyName: ASHFORD HOSPITALITY TRUST INC

ticker: AHT


text: Continuous Monitoring: Use of automated tools and third-party services for real-time threat detection, vulnerability scanning, penetration testing, and incident alerting. Security Incident Response Plan: A formal plan that includes containment, eradication, recovery, and communication protocols.

companyName: KESTRA MEDICAL TECHNOLOGIES, LTD.

ticker: KMTS


text: Incident Identification and Response A security information and event management process ("SIEM") has been implemented to help promptly identify cybersecurity incidents. In the event of any breach or cybersecurity incident, we have an incident response plan within our SIEM that is designed to provide for action to contain the incident, mitigate the impact and restore normal operations efficiently. We conduct annual reviews of our cyber incident response plan.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: Management Oversight The Bancorp's Information Security Governance Committee (ISGC) is a management committee that reviews and discusses critical information security risks that impact the Bancorp, identifies solutions to address these risks and has oversight of the Bancorp's information technology and information security policies. The ISGC provides cybersecurity reports periodically to the Risk and Compliance Committee and is comprised of the Bancorp's senior information security, information technology and enterprise risk management leaders, including the Chief Information Security Officer (CISO), Chief Information Officer, Chief Technology Officer, Chief Data Officer and Chief Operational Risk Officer.

companyName: FIFTH THIRD BANCORP

ticker: FITB


text: Cyber threats are discussed routinely (weekly, monthly, and quarterly) and ad-hoc based on the activities of that time. These threats are used to gauge the size and competency of the organization, the effectiveness of our tools, the sensitivity of the applications we use, and the security of the fundamental architecture that our system is built upon. This then drives decisions for staff, tools, and changes that may require capital or other funding.

companyName: United Parks & Resorts Inc.

ticker: PRKS


text: As part of our overall risk management, we monitor and test our safeguards and train our employees on the importance of these safeguards. We maintain a formal information security awareness training program for all employees that includes training on matters such as phishing, email security best practices and data protection. Employees also receive random phishing tests at regular intervals to further assess and mitigate overall risk.

companyName: Arq, Inc.

ticker: ARQ


text: The CROC is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Director of Information Security and our Director of Technology Management provide quarterly reports to the CROC regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. Our Board of Directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the CROC reviews our cyber security risk profile on an annual basis. The chairman of our CROC provides a report of its activities to the full Board of Directors at least quarterly.

companyName: HOME BANCORP, INC.

ticker: HBCP


text: The Company and its business units have not been materially affected by risks from cybersecurity threats. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect the Company, see Item 1A Risk Factors. Governance.

companyName: Graham Holdings Co

ticker: GHC


text: Our management team supervises our information security team's efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, or external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Airbnb, Inc.

ticker: ABNB


text: BorgWarner's Board of Directors acknowledges the importance of upholding the trust and confidence of its customers, business partners, employees and other stakeholders. The Board, in conjunction with the Audit Committee, is involved in the oversight of the Company's risk management program, including its Cybersecurity Program. The Cybersecurity Program is managed by the Chief Information Officer ("CIO"), whose information technology ("IT") team is responsible for enterprise-wide information technology, including cybersecurity strategy, policy, standards, architecture and processes. The Cybersecurity Program, including its standards, processes and practices, is benchmarked against recognized cybersecurity frameworks. The Cybersecurity Program continually enhances the enterprise security structure and contingency plans with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing the organization system resilience to minimize the business impact should an incident occur.

companyName: BORGWARNER INC

ticker: BWA


text: Cybersecurity is the responsibility of our information security team, overseen by our Chief Information Security Officer ("CISO"). Our CISO reports to our Chief Information Officer ("CIO"), and our CISO and CIO regularly meet with our Chief Legal Officer ("CLO") to review cybersecurity risks and evaluate their nature and severity, as well as identify potential mitigations and assess the impact of those mitigations on residual risk. Our enterprise risk management program also considers cybersecurity risks, including risks associated with our use of third-party service providers, alongside other company risks, and as part of these efforts, we gather information necessary to identify cybersecurity risks and evaluate their nature and severity, as well as identify mitigations and assess the impact of those mitigations on residual risk. Our enterprise risk management program is reviewed annually with our Board.

companyName: Floor & Decor Holdings, Inc.

ticker: FND


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our and our customer's data and information assets. As such, we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: ZIFF DAVIS, INC.

ticker: ZD


text: Our management team, lead by our Executive Director, Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants. Our management team's experience includes a combined 25 years of experience in managing IT environments including assessing the overall risk management program and material risks, as well as building our cybersecurity framework over the past six years.

companyName: Aligos Therapeutics, Inc.

ticker: ALGS


text: Our Adviser's cybersecurity program includes a comprehensive policy framework, reviewed and updated annually; security awareness and data protection training for all employees, completed annually; technology risk assessments for critical information systems and applications, performed annually and following all changes to these systems; monthly vulnerability scans; quarterly technology risk assessments and the use of software to protect the confidentiality, integrity and availability of our systems, including the use of anti-malware applications and the use of programs that log, monitor and audit system activities. The effectiveness of our Adviser's cybersecurity programs is evaluated regularly through both internal and third-party audits. We may also engage third parties to conduct risk assessments.

companyName: BROOKFIELD REAL ESTATE INCOME TRUST INC.


text: The Information Security organization is led by the CISO. The head of each of the four divisions of the Information Security team reports directly to the CISO. The CISO reports directly to LNC's Chief Information Officer and Head of IT ("CIO"), who is a member of LNC's Senior Management Committee. As a result, all information security personnel report into the CISO, and ultimately the CIO. The CISO also reports indirectly to the Audit Committee of the LNC Board of Directors. Biannually, the CISO reports to the Audit Committee on the cybersecurity risks facing the company and cybersecurity developments generally. In addition, as discussed above, LNC's Internal Audit team reports to the LNC Audit Committee the results of its annual security audit focused on cybersecurity risks. LNC's Chief Compliance Officer reports key Privacy risk indicators and statistics (including those related to cybersecurity risks) to the LNC Audit Committee on a quarterly basis.

companyName: LINCOLN NATIONAL LIFE INSURANCE CO /IN/


text: Management Governance The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by the Enterprise Information Security Steering Committee, led by the CISO. The CISO leverages his decades of experience building and leading cybersecurity programs and teams. The CISO has over 20 years of experience as a Chief Information Security Officer in multiple industries and has received Certified Information Systems Security Professional ("CISSP") and Certification in Risk Management Assurance ("CRMA") certifications. The CISO is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation and response to cybersecurity threats and incidents and is regularly engaged to determine whether the cybersecurity program is functioning effectively in the face of evolving cybersecurity threats.

companyName: ROBERT HALF INC.

ticker: RHI


text: The CIO and CISO collaborate with our internal audit department and external consultants to review information technology-related risks (based upon the National Institute of Standards and Technology (NIST) Cybersecurity Framework) as part of the overall Vistra cyber risk management process. Through these processes, the CIO and CISO are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity threats.

companyName: Vistra Corp.

ticker: VST


text: We describe how risks from cybersecurity threats could materially affect us, including our business strategy, results of operations, or financial condition, as part of our risk factor disclosures at Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.

companyName: Optex Systems Holdings Inc

ticker: OPXS


text: Brunswick's Board of Directors (the Board) and its committees are actively engaged in managing cybersecurity risk and overseeing our information security programs. The Audit and Finance Committee (the Committee) is primarily responsible for oversight of our information technology and information security/cybersecurity programs. The Committee is composed of directors with expertise in technology, audit, finance, and compliance, equipping them to effectively oversee the program. The CISO updates the Committee at each of its regularly scheduled meetings. These reports include updates on our information security/cybersecurity programs and key performance indicators, assessment of the program, emerging risks, policies, procedures, training, and risk mitigation strategies. The CIO and CISO also provide the full Board with information technology and cybersecurity reports on at least an annual basis and with greater frequency as necessary. In addition, the Board oversees Brunswick's long-standing enterprise risk management (ERM) process, which regularly identifies, assesses, and mitigates enterprise and emerging risks, including cyber risks.

companyName: BRUNSWICK CORP

ticker: BC


text: Establishing an Information Technology Steering Committee that is responsible for security administration, including conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; Implementing layers of controls and not allowing excessive reliance on any single control; Employing a variety of preventative and detective tools designed to monitor, block and provide alerts regarding suspicious activity; Continuously evaluating tools that can detect and help respond to cybersecurity threats in real-time; Leveraging people, processes and technology to manage and maintain cybersecurity controls; Maintaining a third party risk management program designed to identify, assess and manage risks associated with external service providers; Performing due diligence with respect to our third-party service providers, including their cybersecurity practices;

companyName: SECURITY FEDERAL CORP

ticker: SFDL


text: Reliance has implemented processes for assessing, identifying and managing material risks from cybersecurity threats, which are integrated into the Company's overall enterprise risk management systems and processes. The Company's cybersecurity risk program is largely based on the U.S. National Institute for Standards and Technology ("NIST") cybersecurity framework and other applicable industry frameworks. The Company regularly assesses the threat landscape and takes a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and containment. The Company has also engaged third parties in connection with the assessment and advancement of its cybersecurity risk management processes. We undertake regular vulnerability scanning, periodic penetration testing and maturity assessments with the support of third parties; vulnerabilities are subsequently addressed based on risk/benefit analyses.

companyName: RELIANCE, INC.

ticker: RS


text: We maintain and continue to expand our investment in the development of our information security management system ("ISMS"). Our ISMS leverages a risk-based approach and is informed by industry standard guidance, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization for Standardization ("ISO") 27001 Information Security Management System Requirements. A material cyber-attack on Company systems, distribution partners and their key operating systems, or any other third -party partners or vendors and their key operating systems may interrupt the ability to operate the Company's business, damage the Company's reputation, or result in monetary damages. The development of the ISMS is focused on the protections of the confidentiality, integrity, and availability of the Company's information system infrastructure as well as the data in the Company's care, custody and control. The Company engages third parties to evaluate certain aspects of the ISMS, provide threat intelligence, and perform vulnerability assessments and other services as needed.

companyName: TUCOWS INC /PA/

ticker: TCX


text: We also maintain a business information security committee (the "ISC") with employee representation across geographies, business lines and business functions. The ISC includes a cross functional group of our employees with expertise and responsibilities in areas such as operations, digital product solutions, information technology, compliance, security, finance, privacy, internal audit and legal risk mitigation. The ISC is managed by our Chief Information Security Officer and meets regularly to receive updates on our cybersecurity posture, emerging risks and new cybersecurity capabilities. Members of the ISC act as points of contact during incident response activities to provide oversight and logistical support to the information security team.

companyName: IRON MOUNTAIN INC

ticker: IRM


text: The Company's cybersecurity team helps identify and assess risks from cybersecurity threats by monitoring and evaluating the Company's threat environment using various methods. Through the use of internal and external risk assessment audits of certain environments aimed at identifying potential areas of cybersecurity risk, external and internal monitoring alerts, and other external and internal tools (such as next generation endpoint security (EDR/XDR), SASE framework, next-gen firewalls, and external-party monitoring of endpoint and cloud security environments), the Company performs ongoing assessments of its cybersecurity risks that are designed to take into account the rapidly evolving cybersecurity threat landscape. Further, in conjunction with its ISO 27001 and SOC2 certifications, the Company undergoes annual external audits that include reviews of its cybersecurity risk assessment processes and policies.

companyName: Willdan Group, Inc.

ticker: WLDN


text: Nevertheless, we recognize that cybersecurity risks are dynamic and continually evolving. We cannot guarantee that future events will not have a material impact. For more information on cybersecurity-related risks, see Item 1A, "Risk Factors", including the risk titled: "Our failure or the failure of third-party service providers to protect our websites, networks, and systems against cybersecurity incidents, or otherwise to protect our confidential information, could damage our reputation and brands and substantially harm our business, financial condition, and results of operations."

companyName: PETMED EXPRESS INC

ticker: PETS


text: We identify, assess and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to personnel and customers, violation of privacy and security laws and other litigation and legal risk, and reputational risks. We have implemented and continue to maintain various cybersecurity processes, technologies, and controls designed to aid in our efforts to assess, identify, and manage such material risks.

companyName: LEGALZOOM.COM, INC.

ticker: LZ


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director of Information Technology/Information Security, Vice President, Legal, Chief Compliance Officer ("CCO"), and Chief Financial Officer ("CFO"). Our Executive Director of Information Technology/Information Security has over ten years of experience in information technology and security, and previously held positions such as Associate Director of Informational Technology and Operations, Senior Manager of Informational Technology, and similar roles at other companies.

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. For more information, please see Item 1A. Risk Factors, the section titled "Risk Factors—Risks Related to Our Company and Our Business— We are subject to cyber security risks and risks of data loss or other security breaches. "

companyName: GIFTIFY, INC.

ticker: GIFT


text: Our Board of Directors is actively involved in overseeing our cybersecurity risk management. Our Board of Directors delegates certain oversight functions to our Audit Committee, which reviews our cybersecurity policies, procedures, controls and audit results. Our Audit Committee receives quarterly updates on our cybersecurity posture, threats and incidents from Aytu's management. Our Board of Directors and our Audit Committee regularly assess the adequacy of our cybersecurity risk management framework and the effectiveness of our mitigation strategies.

companyName: AYTU BIOPHARMA, INC

ticker: AYTU


text: Our cybersecurity risk management and strategy processes are overseen by our Information Technology team. Such individuals have an average of over 20 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the audit committee on any appropriate items. The audit committee holds quarterly meetings and receives periodic reports from management, concerning our significant cybersecurity threats and risk and the processes we have implemented to address them.

companyName: Surrozen, Inc./DE

ticker: SRZN


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats are based on examination guidance published by the Federal Financial Institution Examination Council (FFIEC), an interagency body established under the Financial Institutions Regulatory and Interest Rate Control Act of 1978. Consistent with FFIEC guidance, 1st Source selected and adheres to the risk management framework established by the Cybersecurity Risk Institute known as the "CRI Profile." The CRI Profile is based primarily on the well-known National Institute of Standards and Technology's (NIST) "Framework for Improving Critical Infrastructure Cybersecurity" and is tailored to ensure expectations of financial institution regulators are met. Our processes are designed to meet standards for all seven CRI Profile functions – governance, identification, detection, protection, response, recovery, and supply chain dependency management. In addition, we adhere to security standards set by the PCI Security Standards Council which are designed to ensure secure payments globally.

companyName: 1ST SOURCE CORP

ticker: SRCE


text: While we maintain a strong cybersecurity posture, we continuously strive for improvement and vigilance to mitigate evolving threats within this dynamic environment and protect our stakeholders' interests. Our organization has not experienced any unauthorized access resulting from cybersecurity incidents with a materially adverse effect on our business, operations, or financial condition and we remain cognizant of the potential impact of insufficient cybersecurity measures on our operations. For further insights into additional risks relating to our business, please refer to "Item 1A – Risk Factors - Risk Factors Relating to Our Business."

companyName: Flux Power Holdings, Inc.

ticker: FLUX


text: We have not developed or implemented a formal, enterprise-wide cybersecurity risk management program due to our small size, limited personnel, and early stage of operations. Our approach to cybersecurity consists primarily of commercially available tools such as multi-factor authentication, password protection, and encryption for certain Company accounts. We also rely on third-party custodians and wallet service providers for safeguarding digital assets, and we informally monitor industry alerts and provider communications for potential risks. These measures may not be sufficient to detect or prevent sophisticated or evolving threats, and our ability to evaluate or influence the cybersecurity practices of third-party service providers is limited.

companyName: C2 Blockchain, Inc.

ticker: CBLO


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the Committee) oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program. The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant.

companyName: PACS Group, Inc.

ticker: PACS


text: The Company has established collaboration mechanisms with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers to identify and assess cybersecurity risks.

companyName: VEECO INSTRUMENTS INC

ticker: VECO


text: Increased global cybersecurity vulnerabilities, threats and more sophisticated and targeted cyber-related attacks pose an ongoing risk to the security of our information systems and networks. WTW seeks to manage cybersecurity risks consistent with its general approach to ERM. As further described below, our cybersecurity risk management program is coordinated by cross-functional teams. Technology and cyber risks that meet certain thresholds are escalated and tracked by the ERM team within the WTW Risk function.

companyName: WILLIS TOWERS WATSON PLC

ticker: WTW


text: Our Vice President of Information Technology leads our internal IT team and is responsible for overseeing our information security program. Team members who support our information security program have relevant educational and industry experience. Our IT team members provides regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings. We also participate in a cybersecurity risk insurance policy.

companyName: Danimer Scientific, Inc.


text: Employee Awareness and Training Weatherford offers multilingual training sessions and awareness campaigns to better equip our employees with knowledge and tools to safeguard our information systems. Cybersecurity training occurs during onboarding and refresher courses are taken annually. Weatherford performs simulated phishing campaigns to raise employee awareness and provide guidance on recognizing and reporting potential threats. Employees are encouraged to report on cybersecurity threats, data privacy incidents, or any other concerns.

companyName: Weatherford International plc

ticker: WFRD


text: The Audit Committee receives periodic reports from management on our cybersecurity risks, and our IT team directly reports to the Audit Committee on a periodic basis. In addition, management is obligated to update the Audit Committee, as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Connect Biopharma Holdings Ltd

ticker: CNTB


text: The public policy committee assists the board of directors in fulfilling its oversight responsibility with respect to product cybersecurity, and receives reports at least annually on this topic from the CIO and CISO.

companyName: ABBOTT LABORATORIES

ticker: ABT


text: We have an enterprise risk management program designed to identify and assess enterprise risks. At certain committee and Board meetings periodically throughout the year, management discusses the risk exposures identified as being most significant to the Company and the related actions that management may take to monitor such exposures. Our cybersecurity risk management program is integrated into our enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program.

companyName: Container Store Group, Inc.


text: In early April 2023, we detected a cybersecurity incident as part of our routine security monitoring protocols. In response to the incident, we undertook an investigation with the support of leading cybersecurity experts, reached out to law enforcement, accelerated planned security enhancements, and have taken and will continue to take actions to implement additional safeguards.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. As of 2023, our Information Security Management System has been certified to conform to SOC 2 Type 2 and PCI, and are working to conform to ISO 27001.

companyName: Usio, Inc.

ticker: USIO


text: To supplement our internal controls and processes and to meet these objectives, the Company engages third-party consultants who work closely with the Company's Information Technology manager to collectively manage our cybersecurity, information technology and data privacy programs, as well as perform application security reviews, scans and penetration tests. The Company's senior management team, including its Chief Executive Officer and its Chief Financial Officer, reviews the assessments performed by its third-party consultants and determines the plans to be executed in collaboration with the Information Technology manager.

companyName: NATHANS FAMOUS, INC.

ticker: NATH


text: Our Director of IT and IT Department implement processes around security monitoring and vulnerability testing. Our Director of IT reports at least annually to the Audit Committee and such reporting will include topics such as our risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses and recommendations for changes and updates to policies and procedures.

companyName: Acumen Pharmaceuticals, Inc.

ticker: ABOS


text: In addition, our Enterprise Risk Management ("ERM") program considers cybersecurity risks alongside other company risks. Our enterprise risk professionals consult with cross-organizational leaders to gather information necessary to identify cybersecurity risks, evaluate their likelihood and severity, identify necessary mitigations and assess the potential impact of those mitigations on residual risk. Our ERM Committee, chaired by the Chief Financial Officer ("CFO") and General Counsel ("GC"), and comprised of senior leaders representing each risk domain, integrates global risks, including cybersecurity and compliance, to ensure appropriate prioritization of resources and alignment across the Company. The ERM Committee meets with our Executive Leadership Team and presents at least annually to our Board of Directors on the ERM process and on our risk mitigation actions, including providing reporting focused on compliance and cybersecurity risks.

companyName: INTERNATIONAL FLAVORS & FRAGRANCES INC

ticker: IFF


text: Identified issues are logged within the organization's ticketing system, or managed by the change management policy. Automated monitoring and reporting mechanisms are in place wherever possible and appropriate. Vulnerability and penetration testing is performed by appropriately qualified internal personnel or hired specialist, in managed by the Supplier & Vendor Management Policy.

companyName: Renalytix plc

ticker: RNLXY


text: We design and assess our program based on the ISO 27000 and the National Institute of Standards and Technology (NIST) SP-800 and Cybersecurity Framework. We use these frameworks to help us identify, assess and manage cybersecurity risks relevant to our business and do not intend to suggest that we meet any particular technical standards, specifications or requirements.

companyName: Avery Dennison Corp

ticker: AVY


text: HPE, like all organizations operating in the technology landscape, faces significant and persistent cybersecurity risks, which influence business strategy and operations. To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incident, have materially affected us, including our business strategy, results of operations, or financial condition. Notwithstanding our cybersecurity program, we may not be successful in identifying a cybersecurity risk or preventing or mitigating a cybersecurity incident or vulnerability, which if realized, could reasonably likely materially affect us. Additional information on the cybersecurity risks we face can be found in the section titled "Risk Factors" in Item 1A of Part I of this Annual Report on Form 10-K.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: Our Chief Information Security Officer ("CISO"), in coordination with our Chief Technology Officer, is responsible for leading the assessment and management of cybersecurity risks. The current CISO has over 25 years of experience in information security and presents to the Risk Management and Compliance Committee on a bi-annual basis concerning our cybersecurity program.

companyName: Global Business Travel Group, Inc.

ticker: GBTG