text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan and policy, incident detection and response, vulnerability management policy, disaster recovery and business continuity plans, risk assessments, implementation of security standards and certifications, encryption of data, network security controls, access controls, physical security, asset management, tracking and disposal, systems monitoring, penetration testing, dedicated cybersecurity staff, vendor risk management program, and employee training. In addition, we maintain cybersecurity insurance.

companyName: Arlo Technologies, Inc.

ticker: ARLO


text: RISK MANAGEMENT AND STRATEGY. NeurAxis has developed and implemented a cybersecurity framework intended to assess, identify and manage risks from threats to the security of our information, systems, products and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework and International Organization for Standardization 27001 (ISO 27001) Framework, although this does not imply that we meet all technical standards, specifications, or requirements under the NIST or ISO 27001.

companyName: Neuraxis, INC

ticker: NRXS

secItem: Item 1C


text: Our Cybersecurity Approach and Integration We have implemented processes for overseeing and identifying material risks from cybersecurity threats, and our cybersecurity processes are integrated into the Company's overall risk management system and processes. As part of management's oversight of cybersecurity, our Chief Security Officer ("CSO") presents on our cybersecurity practices to the Nominating and Corporate Governance Committee of our Board of Directors (the "NCG Committee") and to our full Board of Directors on a periodic basis. Our Senior Vice President, Internal Audit & Risk Management (the "Chief Audit Executive"), periodically presents enterprise risks, including cybersecurity risks, to the Audit Committee of our Board of Directors (the "Audit Committee"). Our Chief Compliance Officer regularly attends meetings at the NCG Committee providing insights from the compliance perspective relating to cybersecurity.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: Dominion Energy's Board of Directors, including its finance and risk oversight committee, provides oversight of the Companies' risks from cybersecurity threats. Dominion Energy's Board of Directors as well as its finance and risk oversight committee receive presentations and reports throughout the year on cybersecurity and information security risk from management, including Dominion Energy's chief security officer, director of cybersecurity and chief information officer. These presentations and reports address a broad range of topics, including the Companies' cyber risk management program, updates on recent cybersecurity threats and incidents across the industry, policies and practices, industry trends, threat environment and vulnerability assessments and specific and ongoing efforts to prevent, detect and respond to internal and external critical threats, including management's hosting in 2023 of its second practical exercise with external federal, state and local incident response partners. In addition, Dominion Energy's Board of Directors receives briefings from time to time from outside experts for an independent view on cybersecurity risks, including an assessment by an independent consulting firm of management's response in a ransomware tabletop drill.

companyName: VIRGINIA ELECTRIC & POWER CO


text: Comprehensive Cybersecurity Program: We have implemented a comprehensive cybersecurity risk management program (Cybersecurity Program) that is aligned with the National Institute for Standards and Technology Cybersecurity Framework. Our Cybersecurity Program provides a risk-based approach to cybersecurity, and security controls are tailored so that cost-effective controls can be applied commensurate with the risk and sensitivity of specific information systems, control systems and enterprise data. Our Cybersecurity Program incorporates best practices and industry standards from multiple sources and is designed to comply with applicable regulations. The Cybersecurity Program includes, but is not limited to, the following elements: risk assessment, policies and procedures, training and awareness, auditing, compliance monitoring and testing, and incident response.

companyName: TRANSCONTINENTAL GAS PIPE LINE COMPANY, LLC


text: We have adopted a "defense in depth" cybersecurity strategy and deployed multiple layers of security measures to protect the Company's information assets and detect any potential breach quickly. Our multi-layered protection mechanisms are designed to address the security vulnerabilities inherent not only with hardware and software but also due to human error. In an extreme situation, if all the security layers fail and a breach happens, our multiple detection layers are designed to detect the breach.

companyName: International Seaways, Inc.

ticker: INSW


text: The Audit Committee of the Board (the "Audit Committee") is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including, risk management, and finance, equipping them to oversee cybersecurity risks effectively. The Audit Committee receives briefings on cybersecurity risks from the Executive Director of IT or the Chief Legal Officer as described below in "Management's Role Managing Risk."

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) Cybersecurity risk is addressed as a component of the Company's enterprise risk management program;(2) The security administrator works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact on our business; (3) Our management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk; and (4) We have a cybersecurity incident response plan to identify, assess, respond to, and inform escalating levels of management based on the nature and severity of such incidents.

companyName: Artiva Biotherapeutics, Inc.

ticker: ARTV


text: When engaging third-party critical service providers, we conduct security assessments before engagement and require them to implement comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. As part of such security assessment, we ask the third-party service provider to complete a privacy and security questionnaire, through which we can assess the service provider's security capabilities and maturity, and to provide us with evidence of penetration testing and reports.

companyName: Bumble Inc.

ticker: BMBL


text: The audit committee (the " Audit Committee ") of our Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board at least annually, as part of our corporate risk oversight processes.

companyName: Skye Bioscience, Inc.

ticker: SKYE


text: Through the policies and controls described above, including our incident response policy, members of our management team, including our Chief Financial Officer, our Executive Vice President, Global Risk Management and our General Counsel, as well as representatives of the third-party IT and cybersecurity team are informed about cybersecurity threats and incidents affecting our information systems and direct our efforts to prevent, detect, mitigate, and remediate cybersecurity threats and incidents.

companyName: Kennedy-Wilson Holdings, Inc.

ticker: KW


text: Management policies and procedures We recognize the need to protect our data, systems and technology. We have described related risks in Item 1A under the heading "Risks Related to our Technology and Data." We have previously assessed and periodically measure our security maturity using the US National Institute of Standards and Technology Cybersecurity Framework. ("NIST CSF") supported by other internal and third party assessments. Gaps or perceived weaknesses in our NIST CSF score are highlighted to our Cybersecurity Risk Committee and subsequently to the Board of Directors. A reassessment of our maturity using NIST CSF is being carried out in the early part of 2024. These assessments allow us to prioritize investment into those areas which provide the greatest improvement in the CSF scoring and by implication, our ability to identify, protect, detect, respond and recover from information and cybersecurity incidents. Risks are recorded in OneTrust and are formally assessed monthly, considering likelihood and potential impact and mitigating actions are implemented where possible to reduce identified risks. Controls designed to reduce or eliminate risk are designed into our technology, processes and management of third parties. We conduct regular vulnerability scanning and use a third party for regular penetration testing designed to help us identify new weaknesses or vulnerabilities. In addition, we use the same third party to help us conduct cybersecurity incident simulation which is subsequently used to inform updates to our Cybersecurity Incident Response Plan. We also have procedures designed to assess risks related to the use of third-party suppliers.

companyName: Soho House & Co Inc.


text: The Company's management responsible for developing and executing Dow's cybersecurity policies is comprised of individuals with either formal education and degrees in information technology or cybersecurity, or with experience working in information technology and cybersecurity, including relevant industry experience in security related industries. Additionally, leaders in the Company's information technology function receive periodic training and education on cybersecurity related topics. Certain leaders also obtain industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager.

companyName: DOW INC.

ticker: DOW


text: Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Risk Committee. Aside from more immediate reporting of material incidents to our Board of Directors as described above, our Director of Information Technology provides our Risk Committee an update on cybersecurity at least every other quarter and more often as necessary. This update includes metrics on the effectiveness of technical and human security controls, cybersecurity training program compliance, internal and third-party cybersecurity incidents, and cybersecurity risks.

companyName: Calumet Specialty Products Partners, L.P.


text: While risks from cybersecurity threats have not materially affected our business strategy, results of operations or financial condition, a future cybersecurity incident could do so by, among other things, interrupting our operations, causing reputational harm and/or exposing us to litigation.

companyName: CARROLS RESTAURANT GROUP, INC.


text: Management maintains an inventory of third parties (e.g., vendors, consultants, etc., from whom we may face cybersecurity risk in connection with our relationship) and completes an annual third-party cyber risk assessment. In addition, employees participate in mandatory annual cybersecurity training and management conducts routine social engineering tests to monitor employees' awareness of cyber risks and to train employees on how to identify potential cybersecurity risks.

companyName: NORTHERN OIL & GAS, INC.

ticker: NOG


text: Our information security program is overseen by the Chief Information Security Officer ("CISO"), who is responsible for establishing and executing our enterprise-wide cybersecurity strategy, policies, standards, architecture, and associated processes. The CISO has over 20 years of experience in technology and information security, including extensive leadership experience in the biotechnology and laboratory sectors, and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties.

companyName: NEOGENOMICS INC

ticker: NEO


text: The audit committee receives regular reports from the cybersecurity risk committee concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, incidents, risk and mitigation.

companyName: MANNKIND CORP

ticker: MNKD


text: Cybersecurity Risk Management Strategy We have developed our cybersecurity risk management program (“cybersecurity framework”), including a cybersecurity incident response plan, based on the National Institute of Standards and Technology Cybersecurity Framework’s (NIST CSF) principles: Identify, Protect, Detect, Respond, and Recover, and our cybersecurity framework is intended to address current vulnerabilities and anticipate future cybersecurity threats and risks to our cyber ecosystem. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: CG Oncology, Inc.

ticker: CGON


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program designed to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires, reviews of vendor's written security program and audits. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Milestone Pharmaceuticals Inc.

ticker: MIST


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain management, including our Director of Information Technology, who has more than two decades of information technology and information technology leadership experience. Our Director of Information Technology, under the supervision of our Executive VP and Chief Financial Officer, manages and monitors our cybersecurity risk (including that presented by our information technology service providers). Our Director of Information Technology is responsible for informing our Executive VP and Chief Financial Officer of relevant cybersecurity risks including, as relevant, the prevent, detection, mitigation and remediation of cybersecurity incidents. Our Executive VP and Chief Financial Officer has over two decades of management experience, including oversight over information technology and cybersecurity matters.

companyName: Outlook Therapeutics, Inc.

ticker: OTLK


text: Our cybersecurity program employs various risk-tracking tools, industry data, monitoring, detection and response tools, vulnerability scanning, security dashboards and scorecards and other tools to support our continued evaluation of cybersecurity threats and regulatory requirements. Our cybersecurity program addresses the continuously evolving and extensive attack vectors and methods through layered security controls informed by constant threat analysis. Threats include a wide variety of perpetrators aiming for political, personal or financial gain, utilizing a broad set of tactics including ransomware, advanced malware, DDoS, account takeover, phishing/SMSing and social engineering, among others. These risks threaten our internal systems as well as third-party systems that we use and rely upon for the delivery of services and support of our operations. Our risk mitigation techniques include technology risk management, network segmentation, deployment of enhanced detection tools across our network, systems, databases, and applications and monitoring compliance with security standards.

companyName: CHARTER COMMUNICATIONS, INC. /MO/

ticker: CHTR


text: Our Audit Committee of the Board of Directors has oversight responsibility for risks and incidents related to cybersecurity threats. Our Chief Information Officer is a member of our Enterprise Risk Management Committee and provides the Audit Committee and the Board of Directors periodic reports on our cybersecurity risks and any material cybersecurity incidents.

companyName: AGENUS INC

ticker: AGEN


text: As an international service provider, our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected, we, through our Adviser and Administrator, consult with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we then, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: implementation of industry-leading Cloud solutions and business applications which possess integrated cybersecurity safeguards, anti-malware, antivirus, and threat detection software, mobile device management of business applications, regular vulnerability scans and penetration testing.

companyName: GLADSTONE LAND Corp

ticker: LAND


text: We prepare for security incidents by analyzing threat intelligence, holding periodic cybersecurity incident tabletop exercises, and reviewing lessons learned on a regular basis. Our incident management process is communicated to employees during periodic security awareness training. Our employees are trained to report incidents, including security weaknesses, malfunctions, threats and breaches immediately to the concerned internal departments and to our information security group. Our computer security incident response team is trained to manage incident response.

companyName: SS&C Technologies Holdings Inc

ticker: SSNC


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board of Directors has delegated to the Audit Committee oversight of cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats, and management provides regular reports to the Audit Committee and the Board of Directors regarding cybersecurity and other information technology risks and the processes the Company has implemented to address them.

companyName: Mission Produce, Inc.

ticker: AVO


text: The Audit Committee of our Board of Trustees is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates, as warranted, regarding matters of cybersecurity, including review of significant issues encountered by us, UHS or our third-party managers.

companyName: UNIVERSAL HEALTH REALTY INCOME TRUST

ticker: UHT


text: Cybersecurity Strategy We have established and currently maintain processes designed to assess, identify and manage risks from cybersecurity threats to, among other things, our critical computer networks, third party hosted services, communications systems, and our critical and sensitive data. These cybersecurity processes are designed to secure our networks and information systems and protect our operations and information assets from unauthorized access or attack. Such cybersecurity processes include technical, procedural and organizations safeguards that are built into our overall information technology ("IT") function. Our Board of Directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. As discussed in more detail under "Cybersecurity Governance" below, the audit committee of our Board of Directors provides oversight of our cybersecurity risk management and strategy processes, led by our Head of IT.

companyName: Spero Therapeutics, Inc.

ticker: SPRO


text: Our information technology ("IT") systems are critically important to our existing business operations and growth strategy. We provide services to individuals and others that require us to collect, process, maintain and retain sensitive and personal client confidential information in our IT systems, including patient identifiable health information, financial information and other personal information about our customers and end-users, such as names, addresses, phone numbers, email addresses, identification numbers, sensitive health data, and payment account information. As a result, we are subject to complex and evolving United States privacy laws and regulations, including those pertaining to the handling of personal data, such as HIPAA and CCPA. In addition to protecting the privacy of all health-related information for our members, our IT infrastructure supports the operations of all aspects of our business and ensures that we are able to continue to serve our members' transportation, personal care, and remote monitoring needs and execute our strategy to better connect people with care.

companyName: ModivCare Inc

ticker: MODVQ


text: We have established policies and procedures, including our Incident Response Plan ("IRP"), for assessing, identifying, managing, and responding to events that may jeopardize the company digital information or systems, including protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our IRP provides guidance in the event of a cybersecurity incident, including processes with assigned roles and responsibilities to triage, assess severity, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations and mitigate brand and reputational damage. We conduct regular tabletop exercises to test established policies and procedures for responding to cybersecurity threats and incidents. In addition, employees and stakeholders can report cybersecurity threats, cybersecurity and data privacy incidents, or other concerns through external and internal reporting channels.

companyName: Baker Hughes Co

ticker: BKR


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, whether individually or in the aggregate, have materially affected or are reasonably likely to materially affect us, our business, and our results of operations in Part I, Item 1A in this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: Atlassian Corp

ticker: TEAM


text: The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our cybersecurity risk management program; Cybersecurity awareness training of our employees, incident response personnel, and senior management;

companyName: Arteris, Inc.

ticker: AIP


text: We also utilize third-party cybersecurity vendors to assist us with various aspects of our cybersecurity risk management program. For example, in order to support our cybersecurity incident response procedures, we have retained several third-party cybersecurity firms to monitor the IT threat landscape for our industry. As part of our efforts to manage the risk of cybersecurity threats associated with the use of third parties, we monitor and evaluate the cybersecurity risk profiles of third-party technology providers and consider such risk profiles when selecting third-party technology providers. Any third-party service provider that is granted access to our network is required to comply with our policies regarding information technology and cybersecurity. We also engage several third-party cybersecurity firms to perform independent assessments of the effectiveness of our cybersecurity risk management program and assist us in the continued review of our cybersecurity risk management program in order to reflect the evolving landscape of cybersecurity.

companyName: PBF Energy Inc.

ticker: PBF


text: Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of key cybersecurity risks and incidents through various means. This may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.

companyName: EDUCATIONAL DEVELOPMENT CORP

ticker: EDUC


text: During the fiscal year of this Report, the Company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents that individually or in the aggregate have materially affected or are reasonably anticipated to materially affect the organization. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving, and we continue to remain vigilant. For more information on the Company's cybersecurity-related risks, see "Item 1A. Risk Factors – Risks Related to Cybersecurity, Third-Parties and Technology." The prior incidents enabled us to enhance our operational and cybersecurity risk management practices. The lessons learned have also informed our approach to conducting tabletop exercises simulating potential cyber threats, allowing the Bank to assess and improve our response protocols.

companyName: Stellar Bancorp, Inc.

ticker: STEL


text: We engage third-party vendors, assessors, consultants, auditors, and other third party service providers in connection with the above processes. We recognize that third-party service providers introduce cybersecurity risks. We aim to assess the risks from cybersecurity threats that impact select suppliers and third-party service providers with whom we share personal identifying and confidential information. The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management processes.

companyName: Select Water Solutions, Inc.

ticker: WTTR


text: As cybersecurity risks continue to evolve with multiple threat vectors, Entergy and the Registrant Subsidiaries maintain a comprehensive security strategy to keep current with the changing threats. To inform this effort, Entergy and the Registrant Subsidiaries utilize the National Institute of Standards and Technology Cybersecurity Framework, which consists of standards, guidelines, and best practices to manage cybersecurity risk across the enterprise. A risk-based approach is used to direct security initiatives to the most significant risks and provide the most value in terms of risk reduction and protection. Entergy and the Registrant Subsidiaries use a vendor risk management program to assess and monitor security risks that arise from third-party vendors. In addition, Entergy and the Registrant Subsidiaries utilize technology and threat intelligence services to assess and continuously monitor the cybersecurity risk of key vendors, as identified through the vendor risk management program.

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: CLEAR's information security program is managed by a dedicated Chief Security Officer ("CSO"), who has over 27 years of experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as relevant academic degrees, formal military training, and industry certifications. Our CSO's team is responsible for leading the Company's Enterprise Risk Management Program ("ERM Program"), which integrates our cybersecurity strategy, policy, standards, architecture and processes, and through which we regularly discuss and assess identified cybersecurity risks. Our CSO attends ERM Program meetings where cybersecurity (and other) risks are identified. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds, utilize a range of external experts, such as cybersecurity assessors, consultants and auditors, in evaluating and testing our cybersecurity systems. Further, CLEAR recognizes the importance of managing cybersecurity risks associated with third-party relationships as part of its broader risk management framework, as we are an organization that relies on a variety of third-party vendors, service providers, and business partners, and are aware that these relationships present potential risks to the security and integrity of our information systems. To mitigate these risks, the company works closely with vendors using our risk framework to identify, assess, and monitor potential cybersecurity threats that arise from relationships with external entities. Our approach includes conducting due diligence, enforcing contractual cybersecurity requirements, and implementing third-party cybersecurity best practices designed to align with CLEAR's risk management objectives.

companyName: Clear Secure, Inc.

ticker: YOU


text: Our Cybersecurity Committee is comprised of information technology, finance, legal, human resources and data privacy employees. It meets regularly to review and oversee the Company's data security programs, policies, and strategies, including with respect to cybersecurity risk mitigation, business continuity, and business resiliency. Our Cybersecurity Committee (along with the Chief Financial Officer and General Counsel) also reviews, analyzes, and responds to cybersecurity incidents and breaches.

companyName: KYNTRA BIO, INC.

ticker: KYNB


text: As part of this planning, management conducts regular testing of our incident response plan to increase awareness, establishes key decision-making criteria, ensures effective communication among key stakeholders, and complies with our disclosure obligations.

companyName: Lightstone Value Plus REIT III, Inc.


text: from Cybersecurity Threats have not encountered cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our operations or financial condition. A cybersecurity incident could be deemed to have a material impact on our operations if it caused a disruption to our ability to function as a global organization, including the interruption of our internal and external communications, public reporting, or management of our operations. Refer to "Item 1A. Risk Factors" in this annual report on Form 10-K, including "Our operations could be adversely impacted by information technology system failures, network disruptions, or cybersecurity breaches," for additional discussion about cybersecurity-related risks.

companyName: MICROVISION, INC.

ticker: MVIS


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO. With over 30 years of experience in the field of cybersecurity, the CISO brings a wealth of expertise to her role. Her background includes extensive experience as an enterprise CISO and is well-recognized within the industry. Her in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.

companyName: Flywire Corp

ticker: FLYW


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We continuously assess and strategically invest to improve the resiliency of our information security systems in a dynamic cybersecurity landscape. Our assurance practices are based on internationally recognized standards as implemented by our Global Information Security Team, which is responsible for managing our Security Operations Center. Our cybersecurity risk management program includes protocols for preventing, detecting and responding to cybersecurity incidents, and cross-functional coordination and governance of business continuity and disaster recovery plans. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with our third-party service providers and vendors. We engage internal and external assessors, consultants, auditors, and other third-party experts, to identify opportunities for improvements to our cybersecurity risk management program.

companyName: COTY INC.

ticker: COTY


text: As discussed above, we engage the MSP to assist us with the identification, monitoring and management of cybersecurity risks and rely on the expertise and knowledge of the MSP with respect to supporting our information technology network. The MPS reports periodically to our management team as necessary, including our Chief Executive Officer and Chief Financial Officer. These senior executive officers then brief our board of directors on security matters as required and no less frequently than annually. Our Chief Financial Officer, together with our advisor's Director of Human Resource is responsible for managing our cybersecurity risk and developing mitigation strategies and implementing controls to reduce the likelihood of a cybersecurity incident occurring and to reduce the impact of such an incident should this occur.

companyName: Strategic Realty Trust, Inc.


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as outsourced business critical functions, clinical research, professional services, SaaS platforms, cloud-based infrastructure, encryption and other functions.

companyName: Streamex Corp.

ticker: STEX


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks associated with our use of third-party service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a sizable portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: HOME BANCORP, INC.

ticker: HBCP


text: We engage assessors, consultants or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. To oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Arcellx, Inc.

ticker: ACLX


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. Our Chief Financial Officer and IT consultant provide periodic briefings to the Board of Directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, if any, cybersecurity systems testing, activities of third parties, and the like.

companyName: Protalix BioTherapeutics, Inc.

ticker: PLX


text: Operational Technology The Company has operation technology, consisting of the hardware and software that monitors and controls devices, processes, and infrastructure related to the Company's operational assets. Security protocols for the Company's operational technology follow applicable NERC, FERC and TSA regulations and security directives.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the board of directors. The Incident Response Plan is coordinated through the Information Technology Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: PFS Bancorp, Inc.

ticker: PFSB


text: The assessment, identification and management of cybersecurity-related risks are integrated into the Company's overall Enterprise Risk Management ("ERM") process. Cybersecurity risk is included among the significant residual risks identified during the Company's assessment of business risk. This risk assessment process is used to inform the Company's strategic planning process, and to develop action plans to appropriately address and manage risk. It is also used to focus our Board and its committees on the most significant risks to our Company. In addition, the enterprise risk function has established foundational frameworks for assessing, monitoring and overseeing the Company's risks, including risks from cybersecurity threats. This includes reporting on issues, risk events or incidents and emerging risks to applicable risk committees to provide monitoring of key risk exposures.

companyName: LPL Financial Holdings Inc.

ticker: LPLA


text: Our management and board of directors recognize the critical importance of maintaining the trust and confidence of our business partners and employees, including the importance of managing cybersecurity risks as part of our larger risk management program. While all of our personnel play a part in managing cybersecurity risks, one of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks that we face. Our Audit Committee, comprised of members with substantial experience in information technology governance and risk management, oversees our cybersecurity strategy. They are advised by a virtual CISO consultant with Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP certifications, as well as extensive background in IT infrastructure, risk mitigation, and incident response planning. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Rein Therapeutics, Inc.

ticker: RNTX


text: As part of our overall risk management system, we monitor and test our safeguards, including through the use of automated tools and manual processes, such as vulnerability scanning, penetration tests, and assessments of our technology infrastructure, and regularly train our employees on these safeguards, in collaboration with management, including phishing tests and third party training modules.

companyName: HAWAIIAN HOLDINGS INC


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote resources and personnel, including our VP of IT, who reports to our VP of Finance, to manage the risk assessment and mitigation process.

companyName: Arq, Inc.

ticker: ARQ


text: Company has not and, for the foreseeable future, does not intend to engage third-party assessors or auditing firms with industry-recognized expertise on cybersecurity matters to review specific aspects of the Company's or its vendors' cybersecurity risk management framework, processes and controls.

companyName: AIRWA INC.

ticker: YYAI


text: Our CIO and key members of senior management are accountable for our cybersecurity and data privacy programs and is supported by the Board of the Directors (the "Board"). Our CIO has extensive information technology and program management experience and has served many years in our corporate information security organization. Under the guidance of the Board, the CIO manages day-to-day operations of the security and data privacy functions and proposes changes to our cybersecurity strategy, which is part of our overall information technology strategy. The CIO and the Board meet frequently to discuss cyber and data operations, privacy programs and risks.

companyName: BGSF, INC.

ticker: BGSF


text: At Ingevity, we recognize the paramount importance of cybersecurity in safeguarding sensitive information. We align with industry standards, including the ISO 27001 information security framework, for which we became certified in 2024. Our comprehensive cybersecurity program is led by a team of diverse, highly skilled professionals, and we invest in modern technologies, including artificial intelligence and machine learning, to fortify our defenses. We actively collaborate with local, state and federal agencies, as well as peers in the chemical manufacturing industry to identify the latest threats and implement effective defenses that safeguard our employees and customers.

companyName: Ingevity Corp

ticker: NGVT


text: Our Chief Technology Officer, who has over 40 years of industry experience and has facilitated the management of information security programs at financial institutions for the past 35 years. Our Chief Technology Officer is responsible for technology vendor selection and managing efficiency initiatives, including the implementation and upgrades of core banking technology.

companyName: William Penn Bancorporation


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee’s overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to, technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third-party vendor, of the Trustee’s cyber risk management program.

companyName: HUGOTON ROYALTY TRUST

ticker: HGTXU


text: Our Board of Directors is responsible for the oversight of risk management for the Company, including the review and assessment of the Company's enterprise risk management approach and processes. Our Board of Directors has delegated certain responsibility for the oversight of risks from cybersecurity threats to the Audit Committee. At each regularly scheduled quarterly meeting, and more frequently as necessary, management provides updates to the Audit Committee and our Board of Directors regarding the risks from cybersecurity threats. These updates include information regarding cybersecurity strategies, management structure, mitigation activities and an analysis of any actual or potential cybersecurity incidents.

companyName: KEY TRONIC CORP

ticker: KTCC


text: Our cybersecurity policies, standards, processes and practices are integrated into our enterprise risk management processes and are based on a recognized framework established by the National Institute of Standards and Technology ("NIST") and combined with the Center of Internet Security ("CIS") controls framework are used to develop actionable steps for improving technical defenses and protecting against common threats. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We have established and maintain comprehensive incident response and recovery plans that detail our planned responses to cybersecurity incidents. These plans are tested and evaluated on a regular basis. We periodically assess and test the policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.

companyName: Mueller Water Products, Inc.

ticker: MWA


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident.

companyName: Cosmos Health Inc.

ticker: COSM


text: Additionally, we have adopted a Third Party Risk Management Policy ("TPRM Policy") to provide an integrated framework for the review and selection of our prospective or current third-party contractors and providers. The goal of the TPRM Policy is to identify and analyze risks before engaging in or continuing business with such third parties, so that these risks can be mitigated, monitored, and managed on an ongoing basis. In addition, our Supply Chain Review Board, composed of a cross-functional group of internal management team members, uses a risk-based due diligence approach to evaluate third-party providers. We endeavor to only engage third-party providers after completing a review of the risks associated with such engagement and in accordance with the TPRM Policy. We routinely monitor these third-party engagements, including, among other measures, by requesting regular updates to the provider's security documentation and by reviewing the scope of our agreements with the provider.

companyName: SMARTSHEET INC


text: Our IT team, led by the Vice President of IT and the Director of Network and Information Systems, is responsible for day-to-day assessment and management of cybersecurity risks. Members of our IT team have undergraduate and graduate degrees in relevant fields, including information systems, information assurance, and information technology with a concentration in cybersecurity. Members of our IT team have also obtained relevant certifications, including the Director of Network and Information Systems being a Certified Information Systems Security Professional.

companyName: ALAMO GROUP INC

ticker: ALG


text: Management is responsible for mitigating the Company's risks, including cybersecurity. The Board of Directors has the oversight responsibility for the Company's risk management and has delegated its responsibility over cybersecurity to the Audit Committee.

companyName: Abacus Global Management, Inc.

ticker: ABX


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. Based on our small size and limited number of employees and consultants, we rely extensively on information technology systems managed by third party major service providers to securely process, store and transmit our data to conduct business. Our employees and consultants utilize end point security tools, such as firewalls and anti-virus protection, to protect our data. To date, we have not engaged any assessors, consultants, auditors or other third parties in connection with our risk management system or processes, and believe that, given our size, our current approach to manage cybersecurity risks is adequate.

companyName: Birchtech Corp.

ticker: BCHT


text: Each Old Republic operating subsidiary maintains its own security program based on its particular risk, applicable insurance industry requirements, and mandates and guidance from the CISO and enterprise-wide security advisory team. These programs encompass asset protection, threat identification, monitoring, timely response procedures, containment and recovery measures, and internal escalation procedures. An enterprise-wide information technology team consisting of a working group of information technology leaders representing all operating subsidiaries meets regularly for the review and monitoring of and updates to information security business processes due to significant changes in operating environments, statutory or regulatory changes or changing or emerging threats. Operating subsidiaries are required to report certain cyber incidents based on documented severity classification to the enterprise-wide information technology team. This team consists of key information technology personnel, including the CISO and the Chief Information Officer (CIO). They are responsible for overseeing incident response and escalation to the Company's General Counsel and Chief Financial Officer (CFO) when necessary. As part of the Company's overall risk management strategy, the General Counsel, CFO, and CIO, in consultation with the CEO, navigate escalated incidents for law enforcement and other external engagements and assess the impact and materiality of such incidents on the Company's enterprise-wide business.

companyName: OLD REPUBLIC INTERNATIONAL CORP

ticker: ORI


text: In designing our Information Security Program, we refer to established industry frameworks - in particular, the Federal Financial Institutions Examination Council (FFIEC) and guidance and best practices from the National Institute of Standards and Technology (NIST). The FFIEC framework offers a set of guidelines to help financial institutions effectively manage and mitigate cybersecurity risks. The framework focuses on ensuring the confidentiality, integrity, and availability of sensitive information and systems. NIST is part of the U.S. Department of Commerce and among other initiatives, develops cybersecurity standards, guidelines, and other resources to meet the needs of U.S. industry, federal agencies and the broader public. Activities range from producing specific information that organizations can put into practice immediately to longer-term research that anticipates advances in technologies and future challenges. The Company utilizes these frameworks to assist with the design of our Information Security Program, including risk mitigation controls and processes. While we believe our information security program is well-designed and appropriate for our organization, the sophistication of cyber threats continues to increase and no matter how well designed or implemented the Company's controls are, it may not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A. Risk Factors - Risks Related to Cybersecurity, Data and Fraud.

companyName: RIVERVIEW BANCORP INC

ticker: RVSB


text: In addition, our cybersecurity program includes the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect these information assets. We have implemented security monitoring capabilities designed to alert us to suspicious activity and developed an incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a breach. Our information security team conducts annual information security awareness training for employees involved in our systems and processes that handle customer data and enhanced training for specialized personnel. Additionally, our information security team conducts internal annual audits of our systems.

companyName: INTEGRAL AD SCIENCE HOLDING CORP.


text: Board Reporting. At least annually, the Board reviews the overall status of the Information Security Program and The Corporation's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes. violations.

companyName: Cullman Bancorp, Inc. /MD/

ticker: CULL


text: Our governance structure ensures a comprehensive approach to managing cybersecurity risks and threats, aligning with the Board-approved ISP. The ITBC, which is comprised of several Board members, the CIO, ISO, Chief Executive Officer and Chief Operating Officer, is responsible for establishing and updating the Company's Risk Appetite Statement. The ITSC, appointed by the Board of Directors and comprised of the CIO, ISO, CCO and various other representatives from each area of the Bank, is responsible for overseeing ISP compliance. This involves delineating lines of responsibility and accountability for information security risk management decisions. The ITSC also reviews and approves significant changes to our control environments, ensuring that outside independent organizations conduct annual vulnerability assessments and penetration tests. Furthermore, they examine reports submitted by the ISO.

companyName: Richmond Mutual Bancorporation, Inc.

ticker: RMBI


text: We devote significant resources and have designated senior management to manage the cybersecurity and information security risk assessment and mitigation process. We have established an internal security committee that includes members of our information security/technology, internal audit/compliance, finance and accounting, people operations, and legal teams, to instill a thoughtful security culture across our Company. Our employees and contractors are made aware of our cybersecurity policies through mandatory trainings during onboarding and on an annual basis. We also engage and consult with third parties in connection with our risk assessment processes, including advisors, consultants and auditors. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.

companyName: QuantumScape Corp

ticker: QS


text: Although risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, such incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication.

companyName: Knife River Corp

ticker: KNF


text: We recognize the critical importance of cybersecurity in safeguarding sensitive information, protecting our stakeholders, and maintaining customer trust. Our approach to managing cybersecurity risks, which includes periodic risk assessments, implementing and overseeing governance and policies, an incident response plan, ongoing training and awareness programs, and a commitment to continuous improvement.

companyName: Ranger Energy Services, Inc.

ticker: RNGR


text: The key features of the Program include: • A cybersecurity incident response team under the CISO's direction, which is responsible for monitoring and responding to threats, vulnerabilities, and incidents. • An incident response plan that is managed by the CISO and MetLife's Chief Privacy Officer and tested through cross-functional annual exercises in various geographical regions of MetLife, many of which include participation from senior executives and the Board of Directors. • Information security policies and procedures that are reviewed at least annually and updated to reflect applicable changes in law, technology, practice and emerging threats. • Regular network and application testing and surveillance. • Periodic review of threats, vulnerabilities and other cybersecurity risks, internal and external. • Risk mitigation strategies, including annual internal and third-party risk assessments, as well as cybersecurity and privacy liability insurance intended to defray costs associated with an information security breach. • Vendor management procedures designed to identify and address potential risks associated with the use of third-party service providers. • Employee training programs on information security, data security, and cybersecurity practices and protection of data against cyber threats, at least annually. • A cross-functional approach to addressing cybersecurity risk, with participation from Global Technology & Operations, Risk, Compliance, Legal, Privacy and Internal Audit functions.

companyName: METROPOLITAN LIFE INSURANCE CO


text: Vista has an Incident Response Plan which guides the actions to be taken in the event of a suspected or confirmed cybersecurity incident. The plan includes processes to triage, investigate, contain, and remediate the incident, and is designed to enable compliance with applicable legal and regulatory obligations and mitigation of financial and reputational damage. The Incident Response Plan includes notification to the applicable members of cybersecurity leadership, including Vista's Chief Information Security Officer ("Vista CISO"), and, as appropriate, escalation to an internal ad-hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on the nature of the incident, the incident may also be reported to Vista's Executive Committee, as well as to our Audit Committee and to our full Board, if appropriate. Vista also maintains a Business Continuity Plan, which provides procedures for maintaining the continuity of critical business processes in the event of business interruption, including any that involve cybersecurity incidents which may materially impact operations.

companyName: VISTA CREDIT STRATEGIC LENDING CORP.


text: As of December 31, 2023, we have not detected any cybersecurity threats, including prior incidents, that have materially impacted the Company, our business or our financial results. For an examination of cybersecurity threats that could potentially have a material impact on us, please refer to our Risk Factors discussion in the section titled, "Security breaches, loss of data, and other disruptions could compromise sensitive information related to our business, partners, clients, or members, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and reputation."

companyName: Sharecare, Inc.


text: fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we face potential cybersecurity threats that, if realized, would materially affect us.

companyName: Fortune Valley Treasures, Inc.

ticker: FVTI


text: The VP of IT has served in various roles in information technology and information security for over 25 years, including leading the cybersecurity programs for three public companies. The VP of IT holds undergraduate and graduate degrees in business and has attained multiple cybersecurity certifications including Certified Information Security Manager.

companyName: CECO ENVIRONMENTAL CORP

ticker: CECO


text: Our management team, in conjunction with third-party information technology ("IT") and cybersecurity service providers, is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. BIOLASE's management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by us for strategic cyber risk management, advisory and decision making. Our Audit Committee also provides oversight of risks from cybersecurity threats.

companyName: BIOLASE, INC


text: Impact of Risks from Cybersecurity Threats As of the date of this Form 10-K, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Our processes designed to monitor cybersecurity incidents are also intended to protect our data. Our cybersecurity safeguards, including those provided by third parties, are designed to monitor for unauthorized access, extraction, and deletion of certain sensitive data, large quantities of data, and other anomalous network traffic. These services are designed to monitor both internal and external threats. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems could have significant consequences to our business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See Item 1A. Risk Factors for additional information about the risks to our business associated with a breach or compromise to our IT systems.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: The Audit Committee oversees major enterprise risks and the steps management has taken to monitor and control such exposure, including risks to our information technology infrastructure and security. Members of our legal, compliance, enterprise risk management and information security management teams provide information and updates on any significant issues related to these topics at Audit Committee meetings, which are typically held at least quarterly. The Audit Committee is responsible for ensuring independent examination of management's programs to identify, assess, respond to and monitor risks, which include those performed by internal audit and third party consultants, among others.

companyName: ZILLOW GROUP, INC.

ticker: ZG


text: We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Protopia Global Holdings Inc.


text: As of the date of this Annual Report, the Company has not identified any risks from cybersecurity threats, including as the result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, but there can be no assurance that any such risk will not materially affect the Company in the future. For further information about the cybersecurity risks we face, and potential impacts, see Part I, Item 1A, "Risk Factors."

companyName: ITERIS, INC.


text: Our management team provides the Audit and Finance Committee with quarterly briefings regarding enterprise risks, and reviews enterprise risks with the Board of Directors on an annual basis. Cybersecurity risks are included in these reviews, and our Senior Director, Information Protection & Compliance, CIO and representatives from our management committee on cybersecurity periodically provide more detailed cybersecurity-focused briefings to the Audit and Finance Committee and Board of Directors regarding cybersecurity risks and activities, including notable recent cybersecurity incidents and related responses.

companyName: HAWAIIAN HOLDINGS INC


text: In addition, we have a management Cybersecurity committee, which is comprised of chief executive officer, chief information officer, corporate director of internal audit and executive vice president of finance. The Cybersecurity committee is responsible to set strategy and ensure our cybersecurity program is consistently evaluated and kept up to date with the latest developments in the cybersecurity.

companyName: MONARCH CASINO & RESORT INC

ticker: MCRI


text: Our Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Audit Committee of the Board in conjunction with the Board is actively involved in the oversight of risk, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by seeking to identify, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents that may occur.

companyName: Enova International, Inc.

ticker: ENVA


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led primarily by our Director of Information Technology, who has several years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. Our Director of Information Technology is informed with regard to and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, our management team reports to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually.

companyName: Inhibrx Biosciences, Inc.

ticker: INBX


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our company's broader overall risk assessment process. We refine our cybersecurity program by staying informed on security threats, conducting tabletop exercises to proactively identify areas for improvements, and leveraging third-party cybersecurity firms and investing in enhancements to our preventive and defensive capabilities. We utilize a third-party remediation team on retainer for assistance in investigating and addressing cybersecurity incidents or threats. We maintain procedures for screening and evaluating third-party providers prior to granting them access to our information systems. Depending on the nature of the product or service to be provided, we screen any third-parties that could present a cybersecurity risk through a cyber risk assessment, and we review third-party suppliers post-engagement to identify changes in their security risk profile, including the occurrence of cybersecurity events affecting such suppliers. Contractual and statutory provisions require third-party suppliers to inform us of cyber incidents, in most cases. Additionally, we maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business to cover certain costs related to cybersecurity incidents.

companyName: TD SYNNEX CORP

ticker: SNX


text: Our senior management is responsible for assessing and managing the Company's various exposures to risk, including those related to cybersecurity, on a day-to-day basis, including the identification of risks through an enterprise risk management framework and the creation of appropriate risk management programs and policies to address such risks. Our Risk Management Committee is responsible for assessing and categorizing any significant identifiable risks and presenting them to senior management in a timely manner along with recommendations on how to manage these identified risks. All potential risks are identified, quantified, and categorized in such a manner that they can be ranked and presented to senior management for appropriate disposition (such as avoidance, acceptance, mitigation, etc.). Our CTO and Director of InfoSec have the primary responsibility for managing our cybersecurity program and efforts. We perform internal audits of our internal information technology controls and implementation, and we carry out a tabletop exercise at least once each year to determine our ability to respond to cybersecurity incidents in an effective and efficient manner.

companyName: Rumble Inc.

ticker: RUM


text: Our Board, as part of our risk management function, receives periodic updates on internal controls around information technology and evaluates incidents at least once a year. Our information technology team is led by our Vice President of Information Technology who has extensive experience working with information security systems. Management is responsible for developing and maintaining cybersecurity policies and standards, monitoring ongoing compliance, and ensuring our information security is aligned with our business objectives and strategies.

companyName: Medicine Man Technologies, Inc.

ticker: SHWZ


text: Cybersecurity oversight is provided by our executive officers, who periodically review cybersecurity considerations as part of their general oversight of business operations and IT needs. The Board of Directors has not yet established a dedicated cybersecurity committee or delegated specific oversight responsibility to an existing committee. Cybersecurity risks, to the extent material, are discussed by management with the Board on an ad hoc basis.

companyName: Arculus System Co., Ltd.

ticker: AQLS


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining disaster recovery and business continuity plans, conducting risk assessments, implementing security standards and certifications, encrypting data, maintaining network security controls, access controls, physical security measures, and system monitoring tools, conducting employee training, and maintaining cybersecurity insurance.

companyName: Tracon Pharmaceuticals, Inc.


text: Our Information Security Policy and procedures are reviewed on an ongoing basis. These procedures are implemented by our Vice President of Risk Management, assisted by a managed service provider ("MSP"). Our MSP has over 15 years of experience and possesses various cybersecurity certifications. Third-party service providers can assist us from time to time in identifying, assessing, and managing material risks from cybersecurity threats, including for example cybersecurity consultants and software providers, managed cybersecurity service providers, threat intelligence service providers, forensic investigators, penetration testing firms, dark web monitoring services, and professional services firms, including legal counsel and auditors. By partnering with these specialized providers, we can leverage their insights and expertise to implement cybersecurity strategies and processes that are designed to align with industry best practices.

companyName: Rekor Systems, Inc.

ticker: REKR


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Annual Report, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in "Item 1A. Risk Factors" of this Annual Report.

companyName: FACT II Acquisition Corp.

ticker: FACT


text: Our enterprise-wide cybersecurity program is managed by a dedicated information security team, led by our Head of Cybersecurity, Risk & Trust ("Head of Cybersecurity"). Our Head of Cybersecurity has over 25 years of cybersecurity, information governance, and IT experience in the technology industry.

companyName: Sonos Inc

ticker: SONO


text: The Company has developed an information security program to assess, identify, and manage material risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. An internal cyber risk assessment is conducted annually. The risk assessment is used by management to consider implementing and augmenting cybersecurity controls where feasible and appropriate with the intent of mitigating cybersecurity risk exposure. The Company employs a broad array of cybersecurity tools and controls to manage exposure to cybersecurity risks.

companyName: DILLARD'S, INC.

ticker: DDS


text: Our General Counsel oversees and manages our cybersecurity program. Our General Counsel acts as the coordinator of our cybersecurity team, which includes representatives from our Information Technology department and Compliance department. In addition, he regularly interacts with various department heads from both our New York and Florida regions regarding the prevention, detection, mitigation and remediation of cybersecurity risks. Our General Counsel has an educational background in computer science and has relevant work experience in cybersecurity insurance and risk management.

companyName: FONAR CORP

ticker: FONR


text: At PECO, we are committed to protecting the confidentiality and integrity of our data and systems. Among other things, our key contracts contain requirements that counterparties maintain standards of data security and privacy compliance.

companyName: Phillips Edison & Company, Inc.

ticker: PECO


text: Third Party Risk Management: We have implemented a third party risk management program, which is designed to identify and mitigate cybersecurity threats associated with our use of third party collaborators. Such collaborators are subject to security risk assessments at the time of onboarding and contract renewal, based on established cybersecurity standards that both parties review to ensure an industry-standard level of security is achieved. However, there is no periodic review process in place for assessing vendor compliance with our cybersecurity standards. We use a variety of inputs in such risk assessments, including information supplied by collaborators in response to detailed questionnaires and meetings as well as information from third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party collaborators, as appropriate.

companyName: Vado Corp.


text: Our cybersecurity and information security program is led by the Company's Vice President of Cybersecurity ("VPoC") who reports to our Chief Financial Officer. Our VPoC has served as a technology leader of cybersecurity, information security, infrastructure, and operational functions for over 35 years. The VPoC is supported by the Incident Response Team ("IRT"), a management committee made up of the Co-Chief Operating Officers, Chief Financial Officer, and executives in legal, finance, IT, and audit. The IRT supports the VPoC in assessing and managing risks from cybersecurity threats and in the event of a cybersecurity incident, provides oversight and leadership with respect to incident response.

companyName: TransDigm Group INC

ticker: TDG


text: Our Board of Directors ("Board") and Audit Committee have oversight responsibility for cybersecurity risks and incidents, including compliance with disclosure requirements, collaboration with law enforcement, and related effects on financial and other risks. Findings and recommendations are reported, as deemed appropriate, to the Board. Senior management including our Chief Information Security Officer ("CISO") engages in regular discussions with the Board regarding cybersecurity risks, trends, and any material incidents that may arise. Furthermore, the Board receives briefings on cybersecurity matters from the CISO on our cybersecurity and information security.

companyName: VSE CORP

ticker: VSEC


text: Trustee Oversight Senior personnel from our IT department managed our cybersecurity program on a day-to-day basis. For EQC, o ur Board of Trustees oversaw our IT department's management of our cybersecurity program through its Audit Committee. For EQC LT, our Trustees oversaw our IT department's management of our cybersecurity program.

companyName: EQC Liquidating Trust


text: The Audit and Risk Committee and the entire Board review and approve the Company's Information Security Policy, Incident Response Policy, Third Party Risk Management Policy, Risk Appetite Statement and other relevant policies on at least an annual basis. Our ISO, who has over twenty-five years of experience in the system, network, and cybersecurity space, is responsible for implementing the Information Security Program alongside our Chief Information Officer. The ISO and Chief Information Officer both serve on the Enterprise Risk Management Committee, which is chaired by our Chief Risk Officer. They are supported by our team of technology professionals, who are responsible for information technology security monitoring and for managing the controls designed to identify, detect, protect against, respond to and recover from cybersecurity threats and cybersecurity incidents. The Company engages in a continuous risk monitoring process that seeks to identify the likelihood and impact of internal and external threats to our information security systems and data, and assesses the sufficiency of the controls in place to mitigate these threats to acceptable levels on a risk-based basis. Incidents are reported to and handled under our Incident Response Policy, which designates an incident response team and includes procedures and processes to identify, assess, respond to, mitigate and report on cybersecurity incidents.

companyName: First Internet Bancorp

ticker: INBK


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with the people operations, IT, compliance, and legal departments, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings at least annually.

companyName: BlackSky Technology Inc.

ticker: BKSY


text: We recognize the importance of maintaining the trust and confidence of our investors, patients, business partners, and employees. Our board of directors are actively involved in the oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes, and practices are fully integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the international organization for standardization. In general, we seek to address cybersecurity risks through a comprehensive cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Theravance Biopharma, Inc.

ticker: TBPH


text: Additionally, the Company leverages insights from independently-conducted penetration testing provided by external third-party assessors, as required by the NYSDFS cybersecurity regulations, to discover and evaluate potential vulnerabilities across the enterprise that should be contemplated within the overall cyber risk program. The Company also engages independent third-party auditors to provide additional subject matter expertise, as well as to perform comprehensive independent audits of the Program. Audits are conducted no less than annually to evaluate the effectiveness and maturity of the Program. Audits include a review of the cyber risk assessment process, security control effectiveness, and compliance with regulatory requirements.

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: The medical device industry faces unique cybersecurity challenges, given the sensitive nature of the data and the critical role of devices in patient care. Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as information about our employees, contractors, vendors, suppliers, patients and customers. We are committed to implementing robust security measures to protect against potential cyber threats and vulnerabilities that are constantly evolving across the globe.

companyName: Inogen Inc

ticker: INGN


text: As of December 31, 2024, and through the date of the filing of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual report on Form 10-K.

companyName: Moleculin Biotech, Inc.

ticker: MBRX


text: Our information security function is led by our Executive Director of Global IT Operations ("Head of IT"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.

companyName: Autolus Therapeutics plc

ticker: AUTL


text: The efforts of our information security team to address cybersecurity risk are reviewed by the Company's Risk Department, which oversees our enterprise risk management program. The department focuses on the quality of the Company's risk management process in order to manage risks within acceptable tolerance levels. As it pertains to cybersecurity risk, the Risk Department challenges the processes that the information security team has implemented to identify, assess, control and mitigate cybersecurity risk. The department collaborates with the CISO and other business unit owners impacted by our cybersecurity risk management practices to develop and monitor controls and other processes that mitigate identified risks. In addition, the Risk Department conducts independent risk evaluations related to cybersecurity risk.

companyName: RENASANT CORP

ticker: RNST


text: We also maintain a Cybersecurity Governance Committee, led by our CISO and comprised of senior cross-functional leaders including product, development, operational, and corporate business leaders. The committee oversees our cybersecurity risk management and strategy processes, which are discussed above. Our CISO has over 25 years of prior work experience in various roles involving managing cybersecurity risk, developing cybersecurity strategy, implementing effective information and cybersecurity programs and leading information technology and cybersecurity teams. He graduated with a Bachelor of Science and Master of Science Degree in Electrical Engineering as well as three additional master's degrees, including a Master of Business Administration, and he is a Certified Information Systems Security Professional (ISC2) as well as a Certified Chief Information Security Officer (EC Council).

companyName: Sabre Corp

ticker: SABR


text: Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2023, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on the Company's cybersecurity-related risks.

companyName: CVS HEALTH Corp

ticker: CVS


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: TEJON RANCH CO

ticker: TRC


text: From time to time, we experience cybersecurity threats and attempted breaches and other incidents. We classify and track these events based on significance and implement remediation actions that we consider appropriate to address the risks relating to such incidents. Although we have not experienced material impacts to our business strategy, results of operations or financial condition from any such incidents in the past three years, we cannot guarantee that a material incident will not occur in the future. Refer to "Failure to adequately protect critical data and technology systems could materially affect our operations" under "Item 1A. Risk Factors—Legal, Government and Regulatory Risks" of this Form 10-K.

companyName: WESTLAKE CORP

ticker: WLK


text: Cybersecurity risks and updates are reported and discussed on a regular basis within various Old National and Old National Bank management committees that have operational business or information technology oversight or day-to-day implementation, monitoring, and governance responsibility for information security matters. Those include Old National Bank-level committees such as the Information Security and Technology Risk Management Committee (the "ISTRM"), the Risk Executive Committee, the Security Technology Council and the Cyber Threat Management Council. The ISTRM has direct oversight of the ISP. It is chaired by the CISO and meets regularly (generally monthly and no less than ten times per year) to review the ISP and related cybersecurity matters as outlined in its charter. Members of the ISTRM and the other referenced management committees include the CRO, the CISO, the Chief Information Officer, key senior business operating managers and functional leaders, and other representatives from the Company's Information Security department. Coordination among these committees, and with other business management committees operating outside the auspice of the Company's Information Security or Enterprise Risk departments, is intended to help Old National address information security questions in a consistent, coordinated fashion, maintain front-line visibility of the ISP, and promote compliance with Old National security policies and standards.

companyName: OLD NATIONAL BANCORP /IN/

ticker: ONB


text: To date, the Company is not aware of cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "The Company may be subject to information technology system failures, network disruptions, cybersecurity attacks and breaches in data security, which may materially adversely affect the Company's operations, financial condition and operating results" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: MIDDLEBY Corp

ticker: MIDD


text: Our internal Business Information Security Office ("BISO"), established in 2022, continues to streamline communications between our IT function and business units. The BISO connects several key functions, including Chief Information Officer Business Partnership, business continuity, governance, risk, and compliance.

companyName: IQVIA HOLDINGS INC.

ticker: IQV


text: As of the date of this report, we have not identified any cybersecurity threats or intrusions that have materially affected our strategy, results of operations or financial condition. We and our third-party service providers have, however, been the target of cybersecurity threats and we expect these threats to continue. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.

companyName: Cellectar Biosciences, Inc.

ticker: CLRB


text: The results of such an assessment are regularly presented to the Audit Committee. Notably, these assessments include periodic penetration tests, which allow Tredegar to identify vulnerabilities, refine procedures, and enhance its crisis management and recovery capabilities. The Program is also supported by an organizational structure, involving collaboration across various business sectors and an interdisciplinary Global Data Protection and Cybersecurity Oversight Team that meets regularly to identify information security risks and appropriate risk mitigation strategies. Additionally, because Tredegar recognizes the significant role that its employees play in information security, it provides annual formal information security training to all of its employees that covers critical topics such as phishing and email security best practices.

companyName: TREDEGAR CORP

ticker: TG


text: We have implemented a comprehensive Information Security and Risk Management Program that is designed and maintained to be compliant with all applicable federal and state regulations, and is regularly audited by independent experts to ensure continuous effectiveness and compliance. Key elements of this program include: a comprehensive risk management process, integrated with the Enterprise Risk Management system, that continuously assesses, identifies, and manages current and emerging cybersecurity threats and risks, evaluates the effectiveness of information security controls, and reports the overall risk posture to Executive Management and the Board of Directors. assessment of daily cyber threat intelligence from multiple sources; the use of third-party information security services for continuous monitoring and alerting of information systems, network. and user activity;

companyName: SOUTH PLAINS FINANCIAL, INC.

ticker: SPFI


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our "Risks Related to Data Privacy and Cybersecurity" under Part 1. Item 1A. Risk Factors in this Annual Report.

companyName: Definitive Healthcare Corp.

ticker: DH


text: We maintain a Cybersecurity Incident Response Team (CIRT) to handle technical aspects of the Company's response to cybersecurity events and an Executive Cybersecurity Event Evaluation Team (ECEET) to assess potential business impacts and disclosure requirements related to cybersecurity events. Both teams may engage cybersecurity legal counsel and other external experts in connection with their respective activities. An escalation process facilitates updates to internal governance groups, including the Company's Disclosure Committee and/or the Board of Directors' Audit Committee, each of which also receives a quarterly report from the ECEET chair.

companyName: BANNER CORP

ticker: BANR


text: Members of our management team, including our President of P&T, CDO, and CSO, are responsible for hiring appropriate personnel, approving budgets, helping to integrate cybersecurity considerations into our risk management strategy, communicating key priorities, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security-related reports. We provide regular training for personnel regarding cybersecurity threats, which are intended to equip them with tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes, and practices.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: We employ a comprehensive strategy for identifying and addressing cybersecurity risks that is consistent with the security directives issued by TSA where required and aligned with the U.S. Department of Commerce's National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity. This framework outlines standards and practices to promote the protection of critical infrastructure. We utilize a risk-based approach that focuses on critical systems where failure or exploitation could potentially impact the safety or reliability of our key assets or operations. Cybersecurity risks are integrated into our overall risk management processes, including, for example, quarterly security briefings with senior management, tabletop exercises with operations, finance and other company personnel, and by employing a continuous improvement model for our cyber protection strategy that is aligned with the DHS's National Infrastructure Protection Plan risk management framework.

companyName: KINDER MORGAN, INC.

ticker: KMI


text: Our cybersecurity incident processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Executive Leadership Team, or ELT. The ELT works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified, in addition to notifying the audit and risk committee of the board of directors, as appropriate.

companyName: Silence Therapeutics plc

ticker: SLN


text: To effectively prevent, detect, and respond to cybersecurity threats, the Company employs a multi-faceted cybersecurity risk management program supervised by our Senior Director of Technology Infrastructure and Operations ("Sr Director of Tech"), who reports directly to our CEO. The Sr Director of Tech is responsible for leading our enterprise cybersecurity strategy. This responsibility includes establishing processes designed to prevent and monitor potential cybersecurity risks, assessing potential cybersecurity incidents, implementing mitigation measures, and maintaining the cybersecurity program itself. We do this so that we can continuously enhance our cybersecurity capabilities and strengthen our defensive posture.

companyName: AIR T INC

ticker: AIRT


text: ii. Containment and Eradication, which includes determining the cause and vulnerabilities so that the threat or incident can be isolated and eliminated. iii. Recovery, which includes repairing the impacted systems, and if applicable, notifying and instructing impacted parties of next steps.

companyName: Bausch & Lomb Corp

ticker: BLCO