text: Oversight and Leadership Our Board of Directors has charged the Audit Committee with responsibility for monitoring the Company's processes and procedures for enterprise risk identification, assessment and management, and cybersecurity represents an important component of our overall approach to enterprise risk management.

companyName: Crane NXT, Co.

ticker: CXT


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Members of the Audit Committee receive scheduled updates from senior management.

companyName: Allogene Therapeutics, Inc.

ticker: ALLO

secItem: Item 1C


text: AFG's cybersecurity program is directed by its EISG leadership team that is headed by the AFG CISO and three divisional vice presidents that report to the CISO. This leadership group has collectively over 70 years of cybersecurity work experience, over 90 years of Information Technology ("IT") experience and over 20 years of IT audit experience. This experience involved various roles related to managing information security; developing cybersecurity strategy; implementing and monitoring effective cybersecurity controls and penetration testing. These individuals hold many industry-standard certifications including but not limited to Certified Information Systems Security Professional, Information Systems Security Management Professional, G2700 certification, GIAC Security Leadership Certification, Certified in Risk and Information Systems Control, Certified Information Security Manager, ITL certification and others. The CISO also holds a master's degree in information security. All members of this leadership team are active in their local cybersecurity communities and national conferences. They speak at local universities, local conferences, national conferences, and have conducted training sessions at international conferences like Black Hat, an internationally recognized cybersecurity event series providing the most technical and relevant information security research. Their work has also been used in various best practice case studies by industry leading consulting and research firms.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG


text: Our Cybersecurity Team monitors activity, scans applications and systems for vulnerabilities and risk from cybersecurity threats, and creates action plans to address and track identified cybersecurity threats until they have been remediated. Activities and cybersecurity incidents are reported to our cyber critical incident response team, and the CISO, who briefs our Compliance Committee, a dedicated committee of senior management focused on regulatory compliance. Our Cybersecurity Team also routinely engages with third parties, including government agencies focused on cyber resiliency, to manage risks from cybersecurity threats. For example, we are members of the DoD Defense Industrial Base Collaborative Information Sharing Environment, the National Defense Information Sharing and Analysis Center, and the National Security Agency Enduring Security Framework as well as Infragard, a partnership between the FBI and members of the private sector for the protection of U.S. critical infrastructure. These organizations share real-time cybersecurity threat information and best practices in protecting, detecting, and recovering from cybersecurity threats.

companyName: MERCURY SYSTEMS INC

ticker: MRCY


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. For more information, see Item 1A. Risk Factors.

companyName: X4 Pharmaceuticals, Inc

ticker: XFOR


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee of our board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight of risks from cybersecurity threats.

companyName: UroGen Pharma Ltd.

ticker: URGN


text: cybersecurity threats are evaluated throughout the year by our around-the-clock security operations center, utilizing a variety of third-party subscription and threat intelligence data sources and data collected via internal monitoring and scanning processes;

companyName: TE Connectivity plc

ticker: TEL


text: While we maintain a strong cybersecurity posture, we continuously strive for improvement and vigilance to mitigate evolving threats within this dynamic environment and protect our stakeholders' interests. Our organization has not experienced any unauthorized access resulting from cybersecurity incidents with a materially adverse effect on our business, operations, or financial condition and we remain cognizant of the potential impact of insufficient cybersecurity measures on our operations. For further insights into additional risks relating to our business, please refer to "Risk Factors Relating to Our Business." in Item 1A – Risk Factors contained in Part I of this report.

companyName: Flux Power Holdings, Inc.

ticker: FLUX


text: As part of its oversight responsibility of cybersecurity risk and the overall enterprise risk management process, the Audit Committee of our Board of Directors meets periodically with our CISO, CIDO, and other senior leaders to receive updates on cybersecurity risks and threats (and should they arise, any material incidents), the status of initiatives to strengthen our information security systems, third-party risk assessment outcomes, cybersecurity risk metrics, management's assessments of our security program, and compliance with disclosure requirements. The Audit Committee and senior management report any findings and recommendations, as appropriate to the full Board of Directors for consideration. Wesco's cybersecurity program is regularly evaluated by internal and external experts with the results of those reviews reported to senior leadership and the Board of Directors. We also actively engage with strategic partners, industry groups, and intelligence and law enforcement to better understand macro trends and significant risk concerns to better inform and enhance our cybersecurity policies and procedures.

companyName: WESCO INTERNATIONAL INC

ticker: WCC


text: We take a risk-based approach to information security and have implemented policies throughout our operations that are designed to address threats and our response to actual or suspected incidents. In particular, the CISO is responsible for the ongoing identification and assessment of reasonably foreseeable cybersecurity threats and based on these assessments, evaluating and overseeing the implementation of safeguards for limiting such risks, including employee training and compliance, and detection and prevention mechanisms. If an information security incident occurs, Silvercrest will assemble an incident response team responsible for the identification, remediation, and post-incident review of such incident, engage outside advisors and notify third parties as appropriate and assess the materiality of the nature, scope and timing of a given incident and whether public disclosure is required.

companyName: Silvercrest Asset Management Group Inc.

ticker: SAMG


text: Determination of what resources are needed to address the incident, prioritizing of response activities, forming of action plans, and notification of external parties as needed are then undertaken by executive management and the cross-functional working group, led by our Chief Financial Officer and Manager of Cybersecurity. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our executive management makes the final materiality and disclosure determinations, among other compliance decisions.

companyName: BTC Digital Ltd.

ticker: BTCT


text: Risk Assessments Our Chief Information Officer ("CIO") heads our technology team which establishes processes and procedures to assess technology related risks, including cybersecurity risks, to the company. Protections we have in place include regular network monitoring, vulnerability assessments, and tabletop exercises to inform the company of potential risks and mitigation strategies. We also execute enterprise risk management assessments, which include cybersecurity threat risks.

companyName: HireQuest, Inc.

ticker: HQI


text: • Dustin Howard, Head of Information Security: The Company's Head of Information Security supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the information technology environment. The Company's Head of Information Security also oversees the creation of remediation action plans with the affected business units. Mr. Howard has over 30 years' experience managing various aspects of information technology, and has extensive expertise in information security, compliance, and information technology infrastructure and service delivery. He has served in Head of Information Security, Chief Information Officer and Vice President roles in several public companies and has maintained Certified Information Systems Security Professional ("CISSP") certification since 2001. He has a Bachelor's Degree in Business Administration and a Master's Degree in Information Systems.

companyName: MERCURY GENERAL CORP

ticker: MCY


text: In the event of any significant cyber security incident, FirstEnergy's Cyber Security Incident Response Plan provides for a severity determination by the cyber security incident response team based on factors such as the number of assets affected, the likelihood of inappropriate data exposure, operational impact, reliability impact, and regulatory impact. Dependent upon the severity of an incident, it is FirstEnergy's practice to escalate the incident to the Senior Vice President, Shared Services, the Chief Risk Officer, and the FE senior leadership team, including the Chief Legal Officer, Chief Financial Officer, and Chief Executive Officer. Such members of management then determine whether, based on various factors, the incident requires immediate escalation to the Audit Committee and Operations and Safety Committee, or the full FE Board.

companyName: FIRSTENERGY CORP

ticker: FE


text: Our cybersecurity risk management program is designed to identify, assess, and manage reasonably foreseeable material risks facing Outset from cybersecurity threats. We identify cybersecurity risks in various ways, including but not limited to the ongoing monitoring of our systems using various technologies and processes, monitoring of emerging threats, third-party penetration testing of our device and systems, vulnerability scanning and assessments, and cross-functional risk discussions. We have also received Systems and Organizations Controls 2 (SOC 2) certification for Tablo cloud. We have developed processes to help us track, prioritize, and manage identified cybersecurity risks. For example, risks are defined, categorized, and assigned a risk rating based on potential impact and likelihood, which informs acceptance, mitigation or remediation actions which should be undertaken. The Risk Governance Committee reviews key identified risks and discusses related mitigation actions in response to such risks.

companyName: Outset Medical, Inc.

ticker: OM


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program; our information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which is primarily responsible for overseeing our risk management processes on behalf of our board of directors.

companyName: CASTLE BIOSCIENCES INC

ticker: CSTL


text: Our board of directors and the Risk Committee of the board of directors oversee an enterprise-wide approach to risk management, including cybersecurity risks, intended to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance and enhance stockholder value. The Risk Committee is central to the board of directors' oversight of cybersecurity risks and bears the primary responsibility for this function. The Risk Committee is composed of board members with diverse expertise including, risk management assisting them to oversee cybersecurity risks. The Risk Committee receives regular reports from our Chief Information Officer ("CIO") and provides updates to the full board of directors at each regular meeting of the board of directors, The Risk Committee also reviews all information security plans and policies, which are then recommended to the full board of directors for its review and approval.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: The Board of Directors considers cybersecurity risk as part of its overall risk oversight function. The Audit Committee receives briefings from the IT Director regarding our cybersecurity risk management program at least annually. These briefings include updates on our cybersecurity risks and threats, the status of projects to strengthen the information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape.

companyName: CALAVO GROWERS INC

ticker: CVGW


text: The Company's senior leadership, including across the functions of the Company's safety, legal, government affairs, operations, aviation security, finance, communications and digital technology as well as others when appropriate, support CDR and contribute to the management of cybersecurity and digital risk by attending regular cybersecurity risk reviews and participating in cybersecurity exercises.

companyName: United Airlines Holdings, Inc.

ticker: UAL


text: As a key supplier in the semiconductor ecosystem, security and risk management of our technology systems and processes is critical to ensuring our ability to serve our customers without interruption.

companyName: ENTEGRIS INC

ticker: ENTG


text: The Company also formed the Business Continuity Plan ("BCP") and Cyber Security Risk Committee (the "Security Committee"), which oversees the prioritization and escalation of risks from cybersecurity threats to senior leadership, is chaired by the SVP-IT and the Executive Vice President of Portfolio Operations and People. The Security Committee reports to the Chief Financial Officer and Chief Legal Officer, and the committee's members include senior company leadership responsible for asset management, risk management, marketing, and business development. Collectively, the Security Committee members possess experience in information security, risk management, oversight and legal compliance.

companyName: MACERICH CO

ticker: MAC


text: We strive to assess, identify and manage material risks associated with cybersecurity threats. Our information technology (or IT) department, led by our Chief Technology Officer, is responsible for day-to-day management of potential cybersecurity risks. As part of its management of cybersecurity risks, the IT department designs and implements technology projects and conducts regular Security Awareness Training of the Company's employees, which includes simulated cyber threats and phishing exercises. If a cybersecurity threat is identified, the IT department conducts a preliminary investigation and assessment of such risk, and brings the risk to the attention of our Chief Technology Officer. Our Chief Technology Officer then works with our IT Steering Committee, which is comprised of certain members of our executive management, and our legal personnel, to continue the assessment and make the final determination as to the materiality of such risk. Our IT department, management, and necessary or appropriate third parties collaborate with one another in designing and implementing the response and remediation plan with respect to cyber risks.

companyName: MFA FINANCIAL, INC.

ticker: MFA


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: CULLEN/FROST BANKERS, INC.

ticker: CFR


text: The Audit Committee of the Board of Directors (the "Audit Committee") is responsible for overseeing cybersecurity risk and periodically updates our Board of Directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: Brand Engagement Network Inc.

ticker: BNAI


text: Specifically, the Enterprise Information Security Steering Committee typically meets at least four times per year, or with greater frequency as necessary, to: • review with management the Company's cybersecurity threat landscape, risks and data security programs, and the Company's management and mitigation of cybersecurity risks and incidents; • review with management the Company's compliance with applicable information security laws and industry standards; • discuss with management the Company's cybersecurity, technology and information systems policies, including the guidelines and policies established by the Company to assess, monitor and mitigate the Company's significant cybersecurity, technology and information systems related risk exposures; and • review and provide oversight on the Company's crisis preparedness with respect to cybersecurity, including Incident response preparedness, communication plans and business continuity capabilities.

companyName: ROBERT HALF INC.

ticker: RHI


text: Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats; effective management of security risks; and resiliency against incidents. Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers, suppliers, and other third parties, our information systems, our business operations, and our products and related services. We have adopted security-control principles based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework, other industry-recognized standards, and contractual requirements, as applicable. We also leverage government partnerships, industry and government associations, third-party benchmarking, the results from regular internal and third-party audits, threat intelligence feeds, and other similar resources to inform our cybersecurity processes and allocate resources.

companyName: BOEING CO

ticker: BA


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our customers and employees ("Information Systems and Data").

companyName: Arlo Technologies, Inc.

ticker: ARLO


text: The Company conducts periodic assessment and testing of the Company's policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are published in monthly cybersecurity dashboards that are shared with our CFO. Based on the monthly reports, the CFO, with support from the VP of Information Technology, evaluates and provides a summary report to the Audit Committee on an annual basis. We review and train our employees on our cybersecurity policies, standards, processes, and practices annually or more frequently depending on needs identified within the monthly cybersecurity dashboards.

companyName: Canopy Growth Corp

ticker: CGC


text: The Audit Committee (i) periodically reviews the Company's policies related to cybersecurity and data protection, which include the assessment, identification and management of material risks, mitigation strategy, governance and incident reporting, (ii) routinely coordinates with management and the Board of Directors, as applicable, in exercising its oversight over cybersecurity matters, (iii) receives timely information related to cybersecurity threats and incidents that meet specified materiality thresholds, as well as ongoing updates regarding any such threats or incidents until they have been addressed.

companyName: WillScot Holdings Corp

ticker: WSC


text: Service Providers The company relies on third party vendor services and solutions to support its operations. Many of these vendors have access to sensitive and proprietary information. Third party vendors continue to be a notable source of operational and informational risk. Accordingly, the Company has implemented a "Third Party" Management program, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The program is audited as part of the Company's internal audit program.

companyName: Winchester Bancorp, Inc./MD/

ticker: WSBK


text: Our dedicated cybersecurity incident response team, the Security Incident Response Team (SIRT), is comprised of internal resources and an external vendor, Managed Security Services Provider (MSSP). The MSSP triages and validates true positive events and then communicates to the internal SIRT team for deeper investigation and response.

companyName: UNISYS CORP

ticker: UIS


text: Each year, management prepares and provides to the Board and its committees a corporate risk assessment (CRA), which analyzes and prioritizes enterprise-wide risks, highlighting top risks and trends (including cybersecurity). The annual CRA is an integrated enterprise-wide process which engages each part of our business to assess and rank risks based on impact and probability. We strive to ensure that mitigation measures are appropriately designed, prioritized and resourced. The CRA report is reviewed by the Board committees with responsibility for the risk categories relevant to their mandate and is provided to the Board, which coordinates Enbridge's overall risk management approach. Complementary to the CRA, management prepares and provides to the Safety and Reliability Committee an annual top operational risk report that highlights the highest consequence operational risks across Enbridge and includes further detail on the risks and their treatment. This information helps inform the Board about the potential impact of top operational risks and of treatments in place to manage those risks.

companyName: ENBRIDGE INC

ticker: ENB


text: The information security team's review process does not, and cannot, guarantee that a Company vendor will not suffer a cybersecurity incident that impacts us. Due to the possibility that a vendor's information security may be breached, we also negotiate provisions in vendor contracts that address cybersecurity incidents. In addition to including provisions that address the parties' relative responsibility for damages resulting from a cybersecurity incident at a vendor, these contracts also typically include provisions to ensure that the Company receives timely and complete notification of a cybersecurity incident and cooperation in responding thereto so that we can assess the extent of the incident's impact on the Company's systems or information, mitigate any adverse effects arising therefrom and comply with any customer or regulation notification requirements and other legal, regulator or contractual obligations.

companyName: RENASANT CORP

ticker: RNST


text: Board Oversight of Cybersecurity Risks Our Board provides strategic oversight on cybersecurity matters, including material risks associated with cybersecurity threats. Our Board receives periodic updates from our Chief Legal Officer, President, and Director of Information Technology and more frequently as needed, regarding the overall state of our cybersecurity program, information on the current threat landscape, and material risks from cybersecurity threats and cybersecurity incidents.

companyName: Nxu, Inc.

ticker: NXUR


text: The Company's Kimball Electronics Support Center ("KESC") serves as the central point for all cybersecurity incidents and reporting, including incidents that directly target employees or our information systems and incidents originating from third parties. The KESC monitors, detects, alerts, and responds to cybersecurity incidents, evaluating each incident pursuant to our Cybersecurity Incident Response Plan. The KESC escalates incidents with significant impact and pervasiveness to the Company's Cybersecurity Incident Response Team ("CIRT") for further action. Depending on the nature of the attack or indicator, our MSSP will collaborate with our KESC, CIRT, and senior members of our information technology department in response to incidents to contain, mitigate, respond to, investigate and eliminate threats. Where appropriate, the CIRT will escalate incidents to the Audit Committee and the Board for additional consideration, action, and potential disclosure.

companyName: Kimball Electronics, Inc.

ticker: KE


text: Our Risk Committee oversees the Company's management of key risks including those arising from cybersecurity threats. Our management team reports to the Risk Committee on a quarterly basis, presenting their assessment of key enterprise risks, including cybersecurity. The topics include trends in cyber threats and the initiatives designed to strengthen our security systems and enhance the cyber readiness of our organization. Additionally, at least annually, our management team and our Chief Information Security Officer ("CISO") update the members of the Risk Committee and the Board of Directors on existing and new cybersecurity risks, status of risk mitigation efforts, cybersecurity incidents, if any, and the progress of key information security initiatives.

companyName: MAGNACHIP SEMICONDUCTOR Corp

ticker: MX


text: Technology risks, including cybersecurity threats, undergo a thorough risk management assessment. We evaluate risks quantitatively and qualitatively to determine both the probability and potential severity of such risks and whether any such risks could materially affect Voya. We have experienced and may continue to experience cybersecurity incidents and threats that could materially affect our business strategy, results of operations or financial condition. There have been no known cybersecurity incidents that have materially affected us in the past three years. For more information about the cybersecurity related risks that we face, see Interruption or other operational failures in telecommunication, cybersecurity, information technology and other operational systems, including as a result of human and process error or a failure to maintain the security, integrity, confidentiality, or privacy of such systems, could harm our business in Risk Factors in Item 1A of this Annual Report on Form 10-K.

companyName: Voya Financial, Inc.

ticker: VOYA


text: To date, Mercalot Inc. has not experienced any material cybersecurity incidents, and no specific threat has materially affected or is reasonably likely to materially affect the Company's business strategy, operations, or financial condition. However, the Company recognizes that its reliance on cloud infrastructure and digital communication tools poses an ongoing cybersecurity risk and will continue to assess and strengthen controls as operations scale. Management plans to formalize its cybersecurity policies and implement internal training protocols as the business grows.

companyName: Mercalot Inc.


text: We maintain procedures and processes designed to evaluate and respond to certain identified risks. We assess potential adverse impact across a variety of factors, such as financial, product roadmap, brand and reputation, operational performance, and our ability to comply with applicable laws and regulations. Potential responses for cybersecurity risks are: • Avoiding activities or situations that could lead to harm. • Engaging in preventative measures, safety protocols, and security enhancements. • Allocating risk through contract or insurance. • Developing contingency plans to address potential negative outcomes associated with cybersecurity risks if they occur.

companyName: Everpure, Inc.

ticker: PSTG


text: The Audit Committee of our board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats. Additionally, the Audit Committee of our board of directors meets on a quarterly basis with our Chief Security Officer about our cybersecurity risk management and strategy, including any significant investigations, and biannually with our Data Privacy Officer about our privacy program.

companyName: Unity Software Inc.

ticker: U


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for developing and maintaining our overall cybersecurity risk methodology and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.]

companyName: BioCorRx Inc.

ticker: BICX


text: We face a number of cybersecurity risks in connection with our business. To date, our business, operating results and financial condition have not been materially affected by cybersecurity incidents. For additional information, please refer to Item 1A. "Risk Factors" in this Annual Report on Form 10-K, including the risk factors under the section titled "Risk Factors—Risks Related to our Technology and Intellectual Property."

companyName: OneStream, Inc.

ticker: OS


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, financial condition, or results of operations, under the heading "Disruptions to our information technology systems, including failure to prevent outages, maintain security, and prevent unauthorized access to our information technology systems and other confidential information, could disrupt our business and materially and adversely affect our reputation, consolidated results of operations, and financial condition" included as part of our risk factor disclosures included in Item 1A of this report, which disclosures are incorporated by reference herein.

companyName: COPART INC

ticker: CPRT


text: Our Board considers cybersecurity risk as part of its risk oversight function. The Board oversees the Company's overall risk framework including management's implementation of our cybersecurity risk management program. The Board receives reports from the Chief Risk Officer on a regular basis on cybersecurity and information technology risk management.

companyName: Priority Technology Holdings, Inc.

ticker: PRTH


text: Third-party Engagements: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by our use of third-party vendors, service providers, and other external users of the Company's systems. We also monitor our use of systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on the Company's cybersecurity systems.

companyName: V2X, Inc.

ticker: VVX


text: See Item 1A, Risk Factors, for additional information on the Company's cybersecurity risk profile, in particular the risk factor under the headings entitled " Risks relating to data privacy could create additional liabilities for us ".

companyName: CorMedix Inc.

ticker: CRMD


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. See Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks.

companyName: CIMPRESS plc

ticker: CMPR


text: These measures are to be seamlessly integrated into our broader operational risk management framework aimed at minimizing exposure to unnecessary risks across our operations. For cybersecurity, we collaborate with expert consultants and third-party service providers to implement industry-standard strategies aimed at identifying and mitigating potential threats or vulnerabilities within our systems. Additionally, the policy strategy will have a comprehensive cyber crisis response plan to manage high severity security incidents, ensuring efficient coordination across the organization.

companyName: THUNDER MOUNTAIN GOLD INC

ticker: THMG


text: Our Audit Committee of our Board of Directors has oversight of our cybersecurity program and is in the process of implementing procedures to obtain regular updates on our cybersecurity program, including recent developments, key initiatives to strengthen our systems, applicable industry standards, vulnerability assessments, third-party and independent reviews, and other information security considerations. Our cybersecurity program is led by Mohan Gundu, our Senior Vice President of Engineering and Cloud Platform. Mr. Gundu holds an MBA in Business Administration from Babson College, a Master of Science in Computer Science from Worcester Polytechnic Institute and a Bachelor of Technology in Electronics and Communication from Jawaharlal Nehru Technological University. Mr. Gundu has over 20 years of development experience focused on architecture and security. Mr. Gundu has led transformative projects, cultivated cybersecurity awareness and promoted holistic cybersecurity practices that were aligned with policies defined and approved by management. Mr. Gundu and his team are dedicated to integrating security into development, ensuring robust cloud security, enforcing security policies, and driving shift-left practices with operational excellence at the Company.

companyName: VEEA INC.

ticker: VEEA


text: The cybersecurity risk management program, processes and strategy described in this section are limited to the personal and business information belonging to or maintained by the Company (collectively, "Confidential Information"), our own third-party critical systems and services supporting or used by the Company (collectively, "Critical Systems"), and service providers. The Company's subsidiaries lease to our tenants the properties we own, but we do not have actual or contractual access to the systems or information maintained or used by our tenants. Our tenants are directly or indirectly (through their own service providers) responsible for maintaining programs and processes to protect their systems and information from various risks from cybersecurity threats.

companyName: Zoned Properties, Inc.

ticker: ZDPY


text: We also employ a cybersecurity awareness program, which incorporates external expertise and guidance in all aspects of our cybersecurity program, that includes an extensive onboarding training requirement and monthly ongoing training on protecting corporate data and digital assets. We complete annual internal security audits and vulnerability assessments of our information systems and related controls, including systems affecting personal data. In addition, we leverage cybersecurity specialists to complete annual external audits and objective assessments of our cybersecurity program and practices, including our data protection practices, as well as to conduct targeted attack simulations. We continually enhance our information security capabilities in order to protect against emerging threats, while also increasing our ability to detect and respond to cyber incidents and maximize our resilience to recover from potential cyber-attacks. We have a robust incident response plan in place that provides a documented runbook for responding to cybersecurity incidents and facilitates coordination across multiple parts of our entity. Additionally, we have purchased network security and cyber liability insurance in order to provide a level of financial protection, should a data breach occur. Our insurance covers situations arising from, among other things, cyber-related breaches and interruptions in the business continuity of our computing environment. These policies are annually reviewed by industry underwriters at which time our security practices, programs, processes, and procedures are thoroughly disclosed, reviewed, and evaluated for purposes of determining our insurability.

companyName: CIVITAS RESOURCES, INC.


text: The Company is committed to ensuring that it has processes in place to detect, mitigate, and respond to cybersecurity risks. We approach cybersecurity by implementing best practices based on known frameworks. These frameworks include highly developed security checklists that serve as a guide to addressing critical cybersecurity needs. We augment our internal controls to include industry-standard security measures that protect against unauthorized access to our systems and proprietary information. These controls consider cybersecurity risks like potential breaches, technological disruptions, regulatory non-compliance, data theft, and third-party cybersecurity threats.

companyName: Medicine Man Technologies, Inc.

ticker: SHWZ


text: Cybersecurity threats on our information systems are included as a topic considered by our risk committee working group which identifies, assesses and makes related recommendations for managing a number of risks, including cybersecurity threats. This working group is charged with addressing the full spectrum of its risks and managing the potential individual as well as combined impact of those risks as an interrelated risk portfolio. Moreover, the grouping group engages subject matter experts from various departments within the Company to engage in a bi-annual exercise designed to identify potential worse case scenarios, the estimated likelihood of each, and the potential financial impact of each risk, as well as to prioritize such risks, including the risk of a cybersecurity threat.

companyName: GRAYBAR ELECTRIC CO INC


text: The VP of Information Technology has been with our Company for over six years, previously serving as Director and subsequently Senior Director of Global IT Engineering. Prior to joining our organization, he was the Founder, President, and CEO of RjR Innovations, a recognized North American leader in IT Service Management. Over the course of his 27-year career within the Information Technology industry, he has established himself as a subject matter expert and thought leader, having served as both an ITIL Best Practice Conference and Keynote Speaker at various industry events. Supporting the VP of Information Technology is the Director of Cybersecurity & IT Engineering, a seasoned IT professional with more than 25 years of comprehensive experience spanning infrastructure, cybersecurity, architecture, and operations. He has been with our Company for over five years, during which he has held key roles including Senior Solutions Architect, Global IT Engineering and Network Engineer, Global IT Operations. He has also successfully completed advanced executive programs in cybersecurity leadership, including CISO and CISM certifications.

companyName: Canopy Growth Corp

ticker: CGC


text: Employees are the first line of defense against cybersecurity measures. Each employee is responsible for protecting Company and customer information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to monthly simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK


text: Furthermore, our approach to improving readiness for potential cybersecurity breaches is designed to be integrated and coordinated among all aspects of the cybersecurity incident management lifecycle, including that we assess and consistently work to improve our site-level emergency response, our technology and cyber incident response, our executive-level crisis management, our business and operational continuity, our IT resilience and our disaster recovery. These efforts also take into account and balance against cybersecurity risk our Company's business needs and operations, and to inform ourselves in conducting this balancing, we obtain input from appropriate employees from our affected business operations, enterprise risk management, business continuity, business operations, information technology and cybersecurity organizations.

companyName: Sylvamo Corp

ticker: SLVM


text: We recognize the importance of safeguarding the security of our computer systems, software, networks, and other technology assets. We have implemented processes for identifying, assessing, and mitigating cybersecurity risks and we have implemented a cybersecurity risk management program that is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

companyName: TScan Therapeutics, Inc.

ticker: TCRX


text: Risk management is administered at a management level through a multi-disciplinary Enterprise Risk Committee comprised of members of management, including our CDIO. The Enterprise Risk Committee identifies and monitors what we believe to be the key risks currently facing the organization, including cybersecurity risks. A comprehensive presentation regarding our enterprise risk management process and our key risks is presented to the full Board of Directors on an annual basis.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: Our CISO leads our enterprise information security, privacy, and cybersecurity program, which is designed to (i) ensure the security, confidentiality, integrity and availability of our information and information systems; (ii) protect against any anticipated threats or hazards to the security, confidentiality, integrity or availability of such information and information systems; and (iii) protect against unauthorized access to or use of such information or information systems that could result in substantial harm or inconvenience to us, our partners or our customers. We have implemented an industry adopted cybersecurity framework, which is continuously improving. We continuously test and assess our cybersecurity posture, including third-party risk assessments performed by reputable assessors, consultants, and auditors. Additionally, we perform an annual evaluation of our cybersecurity program.

companyName: CORVEL CORP

ticker: CRVL


text: To date, the Company is not aware that its business or operations have been, or are reasonably likely to be, materially impacted by these cyberattacks. However, the Company's security efforts and the efforts of its third-party providers may not prevent or timely detect attacks and resulting breaches or breakdowns of the Company's, or its third-party service providers', databases or systems.

companyName: ENTEGRIS INC

ticker: ENTG


text: Recognizing that information security, stakeholder data, and privacy principles involve more than just systems and infrastructure, we provide semi-annual cybersecurity education and training to all users with access to IT systems, devices, or applications. Internal social engineering phishing campaigns are conducted regularly with the goal of building a culture of cybersecurity, as well as raising awareness and reinforcing best practices across the organization.

companyName: BALCHEM CORP

ticker: BCPC


text: Our Advisor's management and our board of directors provide significant oversight of risks, including those from cybersecurity threats, and are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents applicable to us.

companyName: JLL Income Property Trust, Inc.


text: Our CFO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: IN8BIO, INC.

ticker: INAB


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal health information (including clinical trial data) ("Information Systems and Data").

companyName: SPRUCE BIOSCIENCES, INC.

ticker: SPRB


text: With oversight from the Board of Trustees, the Advisor is responsible for managing all cyber risks and overseeing our security programs. Cybersecurity risk management has been delegated to the Advisor's executive officers, with day-to-day management carried out by the Advisor's Chief Financial Officer (CFO), Elizabeth Reich.

companyName: Sterling Real Estate Trust


text: The CISO has served in various roles in Information Technology and Information Security for over 35 years, including serving in the CISO role of two large public companies, including Associated Bank for 18 years. The CISO holds an undergraduate degree in Management Information Systems and has attained the professional Information Systems Audit and Control Association certification of Certified Information Security Manager in 2005. The CIO holds an undergraduate degree in business management, with a minor in international business, and is currently pursuing a master's degree in cybersecurity and has served in various roles in information technology for over 40 years, including serving as either the Chief Technology Officer or CIO of four public companies. The CRO has over 30 years of banking experience, holds a degree in computer science, and earned the CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors. The Corporation's Chief Executive Officer and General Counsel each hold degrees in their respective fields, and each has extensive experience managing risks at the Corporation and similar financial institutions, including risks arising from cybersecurity threats.

companyName: ASSOCIATED BANC-CORP

ticker: ASB


text: Our Information Security Program includes proactive measures to manage cybersecurity risks and threats, including mandatory annual security awareness training for all personnel with enhanced training for designated information security personnel; enterprise-wide phishing simulations and security assessments; a business continuity and recovery plan in the event of a cybersecurity incident; and the implementation of targeted access controls and various other measures, including multi-factor authentication, with respect to certain systems containing sensitive information. We have also implemented an incident response plan to guide our response to cybersecurity incidents, with a dedicated, cross-functional response team, including senior management from our information technology, information security, operations, finance, risk management, investor relations and legal teams, responsible for overseeing efforts related to detection, containment, threat mitigation and notification, as appropriate. We identify vulnerabilities in our information systems through proactive scanning of system assets for known vulnerabilities. Our outsourced managed security source operates 24/7, identifying threats and vulnerabilities, and our information security team regularly monitors alerts and meets to discuss trends in cybersecurity threats. We proactively manage vulnerabilities from major software publishers through a global patching program. To prevent unauthorized access to our information systems, we have a system of controls in place to manage user access to our information systems. Our employees acknowledge an acceptable use policy and are trained in how to identify information security risks in the workplace.

companyName: PENSKE AUTOMOTIVE GROUP, INC.

ticker: PAG


text: We provide mandatory cybersecurity training at least annually to our personnel with network access, including training designed to simulate and help prevent phishing and other social engineering attacks. We also employ systems and processes designed to oversee, identify and reduce the potential impact of a security incident at a third-party vendor, service provider or otherwise implicating the third-party technology and systems we use. These systems and processes are designed to the third party's risk level and may include, for example, conducting upfront diligence of the third party's certifications and security program, using contractual provisions that address cybersecurity risks and conducting additional monitoring of the third party's security practices. Additionally, we maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our cybersecurity and information technology infrastructure. However, our insurance coverage may not sufficiently cover all types of losses or claims that arise or be subject to exclusions.

companyName: WELLTOWER INC.

ticker: WELL


text: Everest provides resources and learning opportunities to educate all of our colleagues on how to identify, report and be vigilant against cybersecurity threats in the workplace. In addition, we conduct cybersecurity incident simulation exercises with business, information technology, management and other key stakeholders to practice and test response processes. Furthermore, the Company collaborates with industry associations, government and regulatory authorities, peer companies and external advisors to monitor the threat environment and to inform its cybersecurity practices.

companyName: EVEREST REINSURANCE HOLDINGS INC


text: Oversee Third-Party Risk The Company has processes to oversee and identify material risks from reported cybersecurity threats from any third-party service providers or vendors. The Company's vendor management program requires initial due diligence, on-going monitoring, and annual recertification of third-party cybersecurity controls.

companyName: FLUSHING FINANCIAL CORP

ticker: FFIC


text: The Audit Committee receives periodic reports relating to risk assessment and risk management, including cybersecurity threats, from our senior management, including our Chief Executive Officer, Chief Financial Officer, General Counsel, Chief Information Security Officer, the head of our Internal Audit Department, and our Vice President of Risk Management. A cybersecurity update is provided to the Audit Committee at least quarterly. Members of our Audit Committee, and certain of our executive officers, including our Chief Executive Officer, General Counsel, and Chief Information Security Officer, are participants in IANS, an industry leading cybersecurity education platform.

companyName: EMCOR Group, Inc.

ticker: EME


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Vice President, Global Head of Information Technology and Chief Information Security Officer and our Security Steering Committee. Our current Vice President, Global Head of Information Technology and Chief Information Security Officer has over a decade of IT management experience, over nine years of cybersecurity management experience and is currently an ISACA Certified Information Security Manager (CISM). He reports directly to our Chief Financial Officer.

companyName: CS Disco, Inc.

ticker: LAW


text: Our Board of Directors provides oversight of risks from cybersecurity threats, in coordination with our Audit Committee and management team. The following is a summary of our governance processes related to cybersecurity risk management:

companyName: TheRealReal, Inc.

ticker: REAL


text: We periodically evaluate, test, and update our policies, standards, and processes to mitigate cybersecurity threats and manage incidents effectively. These efforts include risk assessments, vulnerability assessments and remediations, phishing tests and employee education, and external scans. Additionally, to enhance our capabilities, we periodically engage third-party service providers, including cybersecurity consultants, to incorporate threat intelligence into our processes.

companyName: Celcuity Inc.

ticker: CELC


text: Through these processes, during our fiscal year 2023 and through the date of this filing we did not identify risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see the section titled "Item 1A. Risk Factors – Business and Operational Risk Factors - We have in the past experienced and in the future could experience unauthorized access into our information systems."

companyName: CHARLES RIVER LABORATORIES INTERNATIONAL, INC.

ticker: CRL


text: In response to an identified cybersecurity incident, or as it deems appropriate, the CSIRT Steering Committee will assemble and oversee a CSIRT, comprised of appropriate personnel and subject matter experts depending on the scope and severity of the incident, relevant or impacted business units and entities, and type of information or systems potentially compromised by the cybersecurity incident. When assembled, the CSIRT is responsible for developing and implementing an overall response strategy to contain, control, and remediate the cybersecurity incident, including securing affected systems and/or information, mitigating harmful effects of the incident, preventing further compromises, and communicating information to affected parties, regulatory agencies and law enforcement, as necessary. The CSIRT may seek assistance from or engage external support providers including legal counsel, outside technology or forensic experts, investigation service providers, and others, as appropriate, to assist in the response to the incident, based on its nature and scope. Pursuant to the Plan and at the direction of WEC Energy Group's CAO, the Enterprise Security Director will conduct a post-incident remediation analysis and report findings to the CSIRT Steering Committee. The Plan is tested and reviewed at least annually.

companyName: WISCONSIN ELECTRIC POWER CO

ticker: WELPP


text: We have established a Security and Privacy Steering Committee to provide governance, oversight and leadership in matters relating to information security and privacy within our business. The Security and Privacy Steering Committee's responsibilities include policy development, risk management, compliance with relevant laws and regulations, incident response, ongoing monitoring and improvement of information security and privacy practices. The Security and Privacy Steering Committee is chaired by the CISO and co-chaired by our Director of Compliance (who serves as our privacy officer). The membership of the Security and Privacy Steering Committee is comprised of individuals from cross-functional teams with expertise and responsibilities in information security and privacy, including representatives from our legal department, our finance department and various units within our technology department. Our CTO also currently serves as a member of the Security and Privacy Steering Committee.

companyName: Repay Holdings Corp

ticker: RPAY


text: Our Information Technology governance framework is composed of policies, procedures, standards, and methodologies to identify and manage risks among other aspects, which are governed by reference frameworks and best practices.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: Key elements of our cybersecurity risk management program encompass: a. Risk Assessments: A risk assessment process to identify and evaluate material cybersecurity threats to our systems, data, products, services, and overall IT environment.

companyName: KALTURA INC

ticker: KLTR


text: We have implemented and maintain an Information Security Management System ("ISMS") that covers information security, data protection, cybersecurity, application security, and other areas as necessary. As a part of our ISMS, we evaluate our security risk strategy on an ongoing basis to facilitate our response to the changing cybersecurity threat landscape and build a culture of security within Concentrix, we allocate and evaluate available resources, including technology, infrastructure, and personnel, to support information security initiatives, we regularly identify security risks and prepare and continuously update mitigation and response plans, including with respect to risks related to the use of our third party service providers, we report, investigate, and respond to suspected or confirmed information security risks, and we maintain a business continuity management process to counter potential interruptions to business activities and a data privacy program to protect personal and sensitive information. We regularly evaluate the ISMS for compliance with applicable regulatory, legislative, and contractual requirements, as well as recent trends and developments in security.

companyName: Concentrix Corp

ticker: CNXC


text: We do not currently engage in any business activities that provide revenue or cash flow. Management intends to explore and identify business opportunities, including a potential acquisition of an operating entity through a reverse merger, asset purchase or similar transaction.

companyName: Atlantis Glory Inc.

ticker: AGLY


text: In response to cybersecurity threats to our business, which include threats to our operations, critical infrastructure assets, information systems and data, we have developed a comprehensive cybersecurity risk management program.

companyName: ITC Holdings Corp.


text: We have deployed various safeguards designed to protect our information technology ("IT") systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls. At the management level, these cybersecurity defense systems are overseen by our network administrator who performs services for us on a part-time basis pursuant to the shared services agreement. Our network administrator has more than 20 years of experience with IT systems and holds various IT certifications. Our network administrator reports to, and is in regular contact with, our Senior Vice President-Finance and Senior Vice President. These officers do not have formal IT or cybersecurity training. In the event of a cybersecurity incident, among other things, the network administrator and these officers would consult with one another and, as needed or appropriate, other members of management to determine the appropriate course of action (including whether such incident should be reported to other members of management and/or the audit committee and whether public disclosure should, or is, required to be made).

companyName: BRT Apartments Corp.

ticker: BRT


text: Our Senior Director, Global Information Security and our Vice President of Global Technology Solutions head our Global Technology Solutions Team which is responsible for leading the individuals tasked with maintaining our enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes. Our Senior Director of Global Information Security has over eighteen years of information technology and cybersecurity experience in multiple industries, including building and leading governance, risk, and compliance functions that cover ISO 27001 certified compliance, NIST Cybersecurity Framework assessments, Sarbanes-Oxley ("SOX") information technology compliance, regional compliances, policy management, information technology risk management, vendor risk management, and security awareness. Our Vice President of Global Technology Solutions has over twenty years of experience leading technology organization and managing information security across multiple industries, including SOX 404 compliance, GxP audit and compliance, NIST Cybersecurity Framework assessments, managing incident response and communication with executives and board of directors.

companyName: BeOne Medicines Ltd.

ticker: ONC


text: Key components of the program include: • Continuous threat monitoring and intelligence, with real-time detection capabilities across cloud and on-premise environments. • Periodic risk assessments and threat modeling, covering internal assets and supply chain exposure. • Third-party penetration testing, security audits, and independent assessments conducted at least annually. • A vulnerability management lifecycle to identify, prioritize, and remediate security flaws in infrastructure and applications. • Employee cybersecurity training and phishing simulations, tailored by role and location.

companyName: 8X8 INC /DE/

ticker: EGHT


text: We recognize the critical importance of maintaining the trust and confidence of patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our Board is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. In general, we seek to address cybersecurity risks through a comprehensive approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: GRI Bio, Inc.

ticker: GRI


text: As a smaller reporting company, we currently do not have formalized cybersecurity measures, a dedicated cybersecurity team, or specific protocols in place to manage cybersecurity risks. Our approach to cybersecurity is in the developmental stage, and we have not yet conducted comprehensive risk assessments, established an incident response plan, or engaged with external cybersecurity consultants for assessments or services.

companyName: La Rosa Holdings Corp.

ticker: LRHC


text: A key part of our strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, vulnerability testing, and other exercises focused on evaluating our cybersecurity measures effectiveness. We regularly engage third parties to perform assessments of our cybersecurity program, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Board, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided.

companyName: BOYD GAMING CORP

ticker: BYD


text: Many aspects of our business are dependent upon our computer systems, devices, and networks to collect, process, and store data necessary to conduct many aspects of our business, including the analysis of our products, the maintenance of our intellectual property, the recording and reporting of commercial and financial information, and payroll. We rely on standard operating systems and software from established and reliable third parties to provide security including Microsoft 365, QuickBooks, and Paylocity. The Company does not have in-house information technology personnel. Management makes concerted efforts to select third-party software providers with a demonstrated track-record of effectively addressing cyber-security concerns. In event of a cyber-security incident, we would rely upon these providers. In light of the Company's current size and relatively low cyber-risk profile, management believes that reliance upon experienced third-party providers is the most prudent and cost-effective course.

companyName: Zivo Bioscience, Inc.

ticker: ZIVO


text: One of our Board's key functions is informed oversight of our risk management process, including risks from cybersecurity threats. The Board does not have a standing risk management committee, but rather administers this oversight function directly through the Board as a whole, as well as through various Board standing committees that address risks inherent in their respective areas of oversight. Our Audit Committee has the responsibility to review and discuss with management and KPMG LLP, the Company's independent auditors, as appropriate, our guidelines and policies with respect to risk assessment and risk management, including our major financial risk exposures and the steps taken by management to monitor and control these exposures, including as it concerns risks from cybersecurity threats. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: PDS Biotechnology Corp

ticker: PDSB


text: As a result of the Data Incident, numerous putative class action lawsuits have been filed against us purporting to represent various classes of persons whose personal information was affected by the Data Incident. These class actions assert a variety of common law and statutory claims based on allegations that we failed to use reasonable security procedures and practices to safeguard customers' personal information, and seek monetary and statutory damages, injunctive relief and other related relief. In addition to those putative class action lawsuits, individual claims have been filed or threatened against us as well.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: Increased global cybersecurity vulnerabilities, threats, and more sophisticated and targeted cybersecurity attacks, including those tied to global conflicts, pose a potentially significant risk to the security of our information technology systems, networks and services, as well as the confidentiality, availability and integrity of our data and the confidential data of our employees, customers, suppliers, and other third parties that we may hold.

companyName: Bunge Global SA

ticker: BG


text: Recognizing that humans are often the most vulnerable element of even the most secure computer architectures, Delek has increased the frequency and sophistication of the mandatory training and phishing campaign program for our employees. Delek also conducts monthly reviews of global cybersecurity incidents to ensure that appropriate mitigation measures are in place to guard against similar threats. Delek is committed to enhancing its organizational resilience through a multiyear, comprehensive incident response tabletop drill program. Building upon the success of the two drills conducted in 2023, we are dedicated to continuous improvement and proactive readiness in addressing potential challenges and ensuring the effective management of incidents.

companyName: Delek US Holdings, Inc.

ticker: DK


text: The Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below, the Board's oversight of cybersecurity risk management is supported by its Audit Committee, which interacts with the Company's ERM function, the Company's Senior Vice President and Chief Information Officer ("CIO"), the Global Head of IT Security, who reports directly to the CIO, and other relevant members of management. • Collaborative Approach: We have implemented a cross-functional approach to identifying, mitigating, and managing cybersecurity risks, threats, and incidents through a broad range of controls and supporting processes. • Technical Safeguards: We deploy various technical safeguards that are designed to protect the Company's information systems and information from identified cybersecurity threats. • Incident Response and Recovery Planning: We have established, and maintain, an incident response plan that addresses the Company's planned responses to a potential or actual cybersecurity incident. This plan is periodically reviewed, tested, and evaluated. The incident response plan also includes consideration of disclosure requirements and communication to appropriate parties within the Company. • Third-Party Risk Management: We take a risk-based approach to identifying the cybersecurity risks presented by third-party service providers and encourage our service providers to reduce cybersecurity risks using commercially available safeguards. • Education and Awareness: We provide training for our employees regarding cybersecurity threats as a means to build awareness and equip them with effective tools to identify and address cybersecurity threats, as well as to communicate the Company's evolving information security policies and practices.

companyName: GATX CORP

ticker: GATX


text: The Company has a documented response plan to follow in the event a cybersecurity incident occurs. The plan details how to determine the scope and risk of an incident, incident response, communication of incident results and risks to all stakeholders and how to reduce the likelihood of an incident occurring or reoccurring. On an annual basis, the Company conducts a test of the cyber response plan in order to test its pre-planned actions, facilitate discussions regarding the plan's effectiveness and identify useful strategies and tactics learned from the test. Additionally, the Company's security program is supported by external third-party experts, including outside cybersecurity professionals at a security operations center and expert legal counsel specializing in information technology and cybersecurity.

companyName: EPR PROPERTIES

ticker: EPR


text: We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity, and availability of our information systems.

companyName: DIGITAL REALTY TRUST, INC.

ticker: DLR


text: The underlying controls of our cyber risk management program are based on recognized best practices and standards for cyber security and information technology, including the National Institute of Standards and Technology Cybersecurity Framework. Our approach to cybersecurity risk management includes the following key elements: Endpoint Protection:

companyName: DecisionPoint Systems, Inc.


text: Our Chief Financial Officer is responsible for our cybersecurity program, and our Manager of Cybersecurity is our incident response team leader. In this position, our Manager of Cybersecurity oversees our cybersecurity team, and guides our incident response team, which is comprised of members from across our organization, including cybersecurity, IT support, mining operations, software engineering, compliance and legal, as well as contractors and other partners, as they support our cybersecurity functions. Our Manager of Cybersecurity has nearly two decades of experience in cybersecurity management and policy, achieved through job training, higher education, and military experience, and possesses a background in security and alignment of information technology solutions.

companyName: Riot Platforms, Inc.

ticker: RIOT


text: Our cybersecurity program is integrated into our overall risk management system and processes. Key elements of our cybersecurity risk management program include, among others: Ongoing cybersecurity training and testing for our employees; Regular patching, vulnerability scanning, penetration testing, and network monitoring; Robust IT infrastructure to help reduce opportunities for adverse exploitation; Operational processes that reinforce cybersecurity policies and IT controls; Regular audits to assess our cybersecurity posture, maturity, and progress;

companyName: Clearfield, Inc.

ticker: CLFD


text: Risks from cybersecurity threats are integrated into AngioDynamics' enterprise risk management (ERM) program. The ERM program establishes a risk management framework that seeks to identify, assess, and mitigate risks that could materially impact the Company's business and operation.

companyName: ANGIODYNAMICS INC

ticker: ANGO


text: To date, the Company is not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on the Company's business strategy, results of operations or financial condition. However, despite our security measures, there can be no assurance that the Company, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us.

companyName: Electromed, Inc.

ticker: ELMD


text: As indicated above, we engage third-party providers to assist us with our cybersecurity risk management and strategy. Some of these providers provide us with ongoing assistance (such as threat monitoring, mitigation strategies, updates on emerging trends and developments and policy guidance) while we engage others to provide targeted assistance (such as security and forensic expertise) as needed. Prior to exchanging any sensitive data or integrating with any key third-party provider, we assess their cybersecurity fitness against our risk posture and request changes as we deem necessary.

companyName: QXO, Inc.

ticker: QXO


text: Audit Committee receives periodic reports from management on potential cybersecurity risks and threats and receives presentations on cybersecurity topics from the Company's Information Systems Manager. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.

companyName: Digital Brands Group, Inc.

ticker: DBGI


text: Our cybersecurity risk management program includes, among other key features: • regular cybersecurity risk assessments; • detection and reporting of any cybersecurity events; • robust information security training program that includes annual information security training for all associates, as well as additional role-specific information security training; and • cyber incident response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident to executive leadership and our board of directors.

companyName: Invitation Homes Inc.

ticker: INVH


text: In addition, a cybersecurity operations team is in place, which monitors the environment for cybersecurity incidents on a regular basis. We have incident response plans to assess and manage cybersecurity incidents. These plans include escalation procedures based on the nature and severity of the incident. The most critical incidents, which could be material to us, are escalated to executive management and the Enterprise Cybersecurity MRG. The Enterprise Cybersecurity MRG practices the incident response process through a tabletop exercise facilitated by external consultants. In addition, cyber insurance is in place, which may mitigate the impact of cybersecurity incidents.

companyName: CUMMINS INC

ticker: CMI


text: Board of Directors' Oversight. The Company's Board of Directors oversees the Company's cybersecurity program, including the oversight of risks related to cybersecurity through various committees that are responsible for monitoring and testing the Company's information security. The Board of Directors conducts an annual review of the Company's cybersecurity- related policies. Quarterly, the Company's Senior Vice President, Director of Information Security ("DIS") presents reports to the Audit Committee on vulnerability management and cybersecurity testing effectiveness, emerging threats and industry and regulatory changes that affect cybersecurity, and responds to inquiries from the Audit Committee. In addition, the Technology Committee receives and evaluates quarterly updates from the DIS on cybersecurity performance and on cybersecurity trends and strategies. The Board of Directors receives quarterly updates from the EVP, Chief Risk Officer ("CRO") on cybersecurity metrics and the cybersecurity risk management program's performance.

companyName: CAMDEN NATIONAL CORP

ticker: CAC


text: Our management team, including our CIO, Chief Information Security Office (CISO) and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO (to whom the CISO reports) regularly attends meetings of the Committee. Our management team's experience includes decades of experience working in information security, advanced education, and information security certifications. Kurt Baumgarten, CISO, has a long history of successfully leading Information Security Programs across a diverse array of organizations such as Linedata SA, Indigo Ag, and Matterport. Kurt has multiple security certifications, such as CISA, CRISC, CDPSE, CGEIT, and has earned a master's degree in information security from Norwich University as well as an MBA with a concentration in e-commerce. Dr. Jeffry Nimeroff, CIO, has a 25-year history of building technology groups and integrating Information Security programs at organizations ranging from startups like Hotsocket and Pet360 to established companies at various points in their lifecycle like CDnow, and Bertelsmann Music Group. Dr. Nimeroff has a PhD in Computer Science from the University of Pennsylvania.

companyName: Zeta Global Holdings Corp.

ticker: ZETA


text: The Head of IT brings over a decade of extensive experience in global technology organizations spanning various industries. With a background encompassing more than a decade of expertise in information security, risk management, and compliance, The Head of IT has successfully led cyber security initiatives and ensured compliance with regulatory standards such as the Health Insurance Portability and Accountability Act and The Telephone Consumer Protection Act. The Head of IT is also supported by an Incident Response Team Security Officer ("IRT Security Officer") who provides cross-functional support for cybersecurity risk management and facilitates the response to any cybersecurity incidents. The Company's IRT Security Officer has completed rigorous cybersecurity awareness and threat response training and has the skills to develop effective incident response plans and swiftly mitigate emerging cyber threats. The IRT Security Officer enhances the Company's cybersecurity posture and readiness with expertise in threat detection, incident coordination, and remediation.

companyName: TILT Holdings Inc.

ticker: TLLTF


text: Chief Executive Officer ("CEO") is tasked with oversight of risks from cybersecurity threats. Our CEO interfaces with our consultant periodically to assess vulnerability to cybersecurity threats and determine actions to be taken in response to such threats. In the event risks are identified and actions are recommended by our consultant, our consultant will interface with our CEO in addressing any identified cybersecurity threats.

companyName: Norris Industries, Inc.

ticker: NRIS


text: Our board of directors oversees cybersecurity risk and receives updates, at a minimum, twice a year from the CISO (or designee) regarding cybersecurity, which updates include a review of our Adviser's global security program and cybersecurity, including risks and protections for us and our Adviser. The Global Operational Risk Management Committee, one of our Adviser's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. In addition, the CISO provides quarterly updates to our enterprise risk management committee, which in turn provides quarterly updates to our board of directors, and members of our management team are included in our Adviser's incident response process in the event a cybersecurity incident occurs that could materially impact us.

companyName: Invesco Real Estate Income Trust Inc.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our general counsel, internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Vertex, Inc.

ticker: VERX


text: Furthermore, we conduct annual cybersecurity awareness training for our employees in order to provide them with the knowledge necessary to navigate the digital landscape securely. We understand that cybersecurity is not a static concept but a dynamic discipline, and our security and privacy notice reflects this by incorporating internal audits, penetration testing, active vulnerability scanning and a continuous improvement mindset.

companyName: Simulations Plus, Inc.

ticker: SLP


text: Cybersecurity Risks Cybersecurity Risk Management and Strategy Arcadium Lithium is committed to protecting its information systems and data from unauthorized access, use, disruption, and destruction. Our cybersecurity risk management strategy is designed to detect, assess, and manage cybersecurity risks in an organized and effective manner with active involvement from the board of directors and management. We also endeavor to actively maintain and monitor our cybersecurity program to stay ahead of the emerging cybersecurity threat landscape.

companyName: Arcadium Lithium plc


text: Our Information Security Committee is responsible for the development and implementation of policies and technical measures to reasonably prevent security incidents. The Information Security Committee includes our Chief Financial Officer, Chief Compliance Officer and legal representative. At times we may also engage assessors, consultants, or other third parties to assist with assessing, identifying and managing cybersecurity risk. As part of our risk management process, we conduct assessment and penetration testing, including regular trainings completed by employees of RGC who provide services to us pursuant to the Advisory Agreement and Administration Agreement.

companyName: Runway Growth Finance Corp.

ticker: RWAY


text: Oversee Third-party Risk Third parties with which the Company does business or that facilitate the organization's business activities (e.g., vendors, supply chain, exchanges, clearing houses, etc.) are also sources of cybersecurity risk. Third-party cybersecurity incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber-attacks, including ransomware and supply-chain compromises, could affect their ability to deliver a product or service or result in lost or compromised information. Because we are aware of the risks associated with third-party service providers, we implement stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. Monitoring includes quarterly assessments by our Chief Information Security Officer ("CISO") and on an ongoing basis by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties.

companyName: OLD SECOND BANCORP INC

ticker: OSBC


text: As part of the above approach and processes, we regularly engage with assessors, consultants, auditors, and other third-parties to help identify areas for continued focus, improvement and/or compliance.

companyName: SYNOPSYS INC

ticker: SNPS


text: To assess and manage risk, we have a formal risk assessment methodology. Risk assessments of our key risk categories are conducted on a continuous basis. We perform regular internal audits and we use a third party vendor if we need an external audit. Infosec reviews these assessments and takes action as required to meet compliance requirements. The assessments, along with any mitigation efforts or remediation, are incorporated into our broader risk management process. Between the risk owner, the Infosec team and, in the case of the most severe risks, the Technology Risk Steering Subcommittee (described below), mitigations are decided, and remediation assigned to appropriate teams to implement which is, as needed, overseen by the ERM Steering Committee (described below).

companyName: Thoughtworks Holding, Inc.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Technology Officer leads a team of information security professionals who have primary responsibility for our overall cybersecurity risk management program and supervises both our internal personnel and our external cybersecurity consultants.

companyName: Cardio Diagnostics Holdings, Inc.

ticker: CDIO


text: We recognize the importance of maintaining the trust and confidence of our patients, our collaborators, our business partners, our investors, and our employees and understand how key it is to maintain their confidence in our ability to properly protect and manage our information technology systems, infrastructure and data as part of that trust and confidence. In order to achieve this, our management team and our Board of Directors are actively involved in the oversight of our cybersecurity program as part of our approach to risk management.

companyName: BioAge Labs, Inc.

ticker: BIOA


text: We have instituted cybersecurity event detection systems, methods, and supporting processes to perform continuous monitoring, identify and classify events and anomalies, take appropriate actions when necessary and report incidents to the appropriate parties. Our response and recovery capabilities are designed to, among other things, contain any impacts, analyze and mitigate events, track events to resolution, provide effective stakeholder communication, recover and resume operations, and evaluate and improve systems and methods.

companyName: Texas Pacific Land Corp

ticker: TPL


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection best practices and laws and implement changes to our processes that are designed to comply with such; • annual HIPAA security and privacy risk assessments performed with third party provider, as well as annual HIPAA compliance audits; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including advanced firewall systems, endpoint detection and response, data loss prevention, regular air-gapped backups, and security information and event management, which are evaluated and improved through third-party real-time risk assessments and mitigation of security risks; • provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools, information and education to recognize and address cybersecurity threats; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; • carry and maintain information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and • document internal policies and procedures for cybersecurity incident response and recovery.

companyName: SERA PROGNOSTICS, INC.

ticker: SERA


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk entitled "Our computer systems or data, or those of our collaborators or other contractors or consultants, maybe compromised, which could result in adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; significant disruption of our product development programs and our ability to operate our business effectively; reputational harm; and other adverse consequences."

companyName: PMGC Holdings Inc.

ticker: ELAB


text: we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For further discussion of the risks associated with cybersecurity incidents, see " Risk Factors—Risks Related to Our Business—Interruptions to our information systems may materially and adversely affect our operating results " as well as "— Cybersecurity attacks or other data security incidents could disrupt our operations and expose us to regulatory fines or penalties, liability or reputational harm.

companyName: Guardian Pharmacy Services, Inc.

ticker: GRDN


text: To date, we have not identified any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. For additional information about our cybersecurity risks, see "Item 1A. Risk Factors—If we experience a cybersecurity incident, we may suffer reputational harm and significant legal and financial exposure."

companyName: OUTFRONT Media Inc.

ticker: OUT


text: We maintain a cybersecurity management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats and incidents. We review our program design on at least a quarterly basis and update as needed to address the risks and threats that our corporate security team has identified. Our team also benchmarks our program to industry recognized frameworks, including the International Organization for Standardization. The Audit Committee of the Board of Directors receives regular reports on cybersecurity risks and evaluates these risks as a part of their enterprise risk review.

companyName: National CineMedia, Inc.

ticker: NCMI


text: Effective incident response involves every part of our organization, including IT teams, legal, technical support, human resources, corporate communications, and business operations. Our Board of Directors oversees all business, property and affairs of the Company, including cybersecurity risks. Our management keep the members of the Board informed of our business through discussions at Board meetings and by providing them with reports and other materials throughout the year.

companyName: SCI Engineered Materials, Inc.

ticker: SCIA


text: We engage third-party assessors to conduct penetration testing and evaluate our adherence to industry-standard frameworks. Additionally, we maintain ongoing relationships with incident response experts and other external professionals. We also seek to collaborate with industry peers and cybersecurity practitioners in order to facilitate the exchange of insights and knowledge regarding potential threats, best practices, and emerging trends. We have developed processes to identify and oversee risks from cybersecurity threats associated with our third-party service providers, which includes the information security team assisting with and assessing cybersecurity robustness during onboarding as well as risk-based monitoring on an ongoing basis.

companyName: Rocket Lab Corp

ticker: RKLB


text: We operate in an industry subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or partners; violation of privacy laws and other litigation and legal risk; and reputational risk. We have initiated a risk-based approach designed to identify and assess the cybersecurity threats that could affect our business and information systems. Our strategy is to maintain a high level of risk awareness, identify critical IT assets, regularly update or replace those assets, and systematically perform vulnerability testing, and to promptly remediate deficiencies. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and Cybersecurity and Infrastructure Security Agency ("CISA") best practices.

companyName: IntelGenx Technologies Corp.


text: As of the date of this filing, we are not aware of any current cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For further discussion of the risks related to cybersecurity, see Item 1A. "Risk Factors".

companyName: AMERICAN WOODMARK CORP

ticker: AMWD