text: Cybersecurity Incidents – an unauthorized occurrence on or conducted through its information system that jeopardizes the confidentiality, integrity, or availability of its information systems or any information residing therein Cybersecurity Threats – any potential occurrence that may result in an unauthorized effort to adversely affect the confidentiality, integrity, or availability of its information systems or any information residing therein.

companyName: Kun Peng International Ltd.

ticker: KPEA


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled " Failure of a key information technology system, process or site could have an adverse effect on our business " in the section titled "Risk Factors" in Part 1, Item 1A of this Annual Report.

companyName: Envoy Medical, Inc.

ticker: COCH

secItem: Item 1C


text: Management and Strategy utilize third party applications and resources to support our information technology ("IT") needs. All of the applications we use are Software as a Service ("SaaS") offerings. As our applications are developed and managed by third parties, we are dependent on these providers for many functions including disaster recovery during a disaster or cyber incident. Our goal is to utilize the most secure and trusted providers for our IT needs. Our business continuity plans are evaluated against evolving security and service level standards, which includes evaluating those cybersecurity threats associated with our use of key third party service providers.

companyName: Safe Pro Group Inc.

ticker: SPAI


text: To prevent, detect and respond to information security threats, the Manager maintains a cyber risk management program. The program is supervised by an in-house dedicated Chief Information Security Officer ("CISO") with over 15 years of experience in financial services risk management, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Enterprise Risk Committee ("ERC"), which includes members of management of the Manager, receives regular reports from the CISO on, among other things, the Manager's cyber risks and threats, the status of projects to strengthen the Manager's information security systems, assessments of the Manager's security program and the emerging threat landscape.

companyName: Grayscale CoinDesk Crypto 5 ETF

ticker: GDLC


text: Proactive Defense: We utilize industry-standard mechanisms to assess, identify, and address potential threats from cybersecurity incidents. Our dedicated information technology (IT) team continuously monitors the evolving cybersecurity landscape and develops robust response processes to swiftly and effectively handle emerging threats.

companyName: SES AI Corp

ticker: SES


text: The Board is central to the Company's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Board is composed of members with depth of experience in enterprise risk management, compliance, corporate governance, technology, finance, and the unique characteristics and vulnerabilities of the oil and gas industry, equipping them to oversee cybersecurity risks effectively.

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: The DPM reviews any material cybersecurity threats or incidents, as defined in the IRP, with the Audit Committee when they occur and non-material threats or incidents on a regular basis. Materiality of a cybersecurity threat or incident gives consideration to the potential and actual impact of the cybersecurity threat or incident.

companyName: AMPCO PITTSBURGH CORP

ticker: AP


text: Our board of directors has oversight of our strategic and business risk management and has delegated cybersecurity risk management oversight to the Audit Committee of our board of directors (Audit Committee). Our Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors, including the Audit Committee. In response to the departure of our IT Manager in 2024 and a number of other IT personnel in 2025, the Company's management is in discussions with a number of third parties service providers to provide IT security services as well as the process to hire a new head of IT. In addition, the Company engaged Cyber Risk Opportunities to perform network penetration testing in March 2025 and their findings were reported to the Company's Audit Committee. Each of their findings have been remediated and were contained as of the date of this report.

companyName: BOXABL Inc.


text: We have developed our cybersecurity risk management program ("cybersecurity framework"), including a cybersecurity incident response plan, modeled after the National Institute of Standards and Technology Cybersecurity Framework's (NIST CSF) principles: Identify, Protect, Detect, Respond, Recover, and Govern, and our cybersecurity framework is intended to address current vulnerabilities and anticipate future cybersecurity threats and risks to our Information Systems and Data. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: CG Oncology, Inc.

ticker: CGON


text: Governance and Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats The Audit Committee of the Board (the "Audit Committee") has been designated as the board committee with oversight responsibility of cybersecurity as delegated in the Audit Committee charter. The following summarizes the role and frequency in which the Audit Committee oversees and monitors cybersecurity risks: • At least annually the Vice President of Information Technology presents compliance activities related to cybersecurity to the Audit Committee which includes those activities related to compliance with the cybersecurity disclosure regulations; • Material breaches, if any are, disclosed to the Audit Committee either in regularly scheduled meetings or, if urgent in calls with the Chair of the Audit Committee; • Periodically, the Vice President of Information Technology provides updates to the Audit Committee on internal controls surrounding information technology (including cybersecurity); • The Chair of the Audit Committee provides regular updates during Audit Committee meetings which includes cybersecurity; and • The Vice President of Information Technology presents updates on the cybersecurity program to the Company's Board annually.

companyName: POWER SOLUTIONS INTERNATIONAL, INC.

ticker: PSIX


text: Although we have experienced cybersecurity incidents from time to time that have not had a material adverse effect on our business, financial condition, or results of operations, there can be no assurance that a cyber-attack, security breach, or other cybersecurity incident will not have a material adverse effect on us in the future. For a discussion regarding risks from cybersecurity threats that have or are reasonably likely to affect us, see our risk factors, including the risk factors titled "Our strategy includes an increasing dependence on technology in our operations. If any of our key technology fails, our business could be adversely affected." and "A cybersecurity incident could negatively impact our business and our relationships with employees, service providers, patients, clinical study sites and government agencies." in Item 1A of this Annual Report on Form 10-K.

companyName: SOLIGENIX, INC.

ticker: SNGX


text: The Company has also implemented processes to identify, monitor and address material risks from cybersecurity threats associated with our use of third-party service providers, including those in our supply chain or who have access to our systems, data or facilities that house such systems or data by discussing issues to be addressed and recommending securities measures to be improved where possible.

companyName: R F INDUSTRIES LTD

ticker: RFIL


text: We currently maintain customary cybersecurity tools intended to prevent or detect unauthorized access to our information technology ("IT") networks and applications as well as to mitigate the risk of common cybersecurity threats. We continue to develop and implement additional processes, including those intended to follow an internal IT Security Policy, which will seek to assess, identify, and manage material risks from cybersecurity threats to our IT systems and information that we create, use, transmit, receive, and maintain in our business. We will seek to integrate these processes and policies into an overall enterprise risk management process. We expect our processes for assessing, identifying, and managing material risks from cybersecurity threats, including threats associated with our use of third-party service providers, will include our efforts to identify the relevant assets that could be affected, determine possible threat sources and threat events, assess threats based on their potential likelihood and impact, and identify controls that are in place, or necessary, to manage and/or mitigate such risks.

companyName: MOBIX LABS, INC

ticker: MOBX


text: It is important to note that while we strive to protect our digital assets, no cybersecurity measures can guarantee absolute security against all potential cyber incidents. In the event of a cybersecurity breach, the Company is prepared to take appropriate actions to address the incident, mitigate its impact, and comply with applicable regulatory requirements regarding breach notification and reporting.

companyName: NEXIEN BIOPHARMA, INC.

ticker: NXEN


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems, including, for example, incident detection and response policy, route risk assessments, data encryption, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, penetration testing, and cybersecurity insurance. As part of our information security program, we provide mandatory periodic training for all employees on how to identify potential cybersecurity risks and protect our resources and information. This training is supplemented by firmwide testing initiatives, including periodic phishing tests.

companyName: Eledon Pharmaceuticals, Inc.

ticker: ELDN


text: Our cybersecurity risk management program applies information and direction from industry-recognized cybersecurity frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 (CSF), specifically the NIST 800-171, the Department of Defense Cybersecurity Maturity Model Certification (CMMC) Level 2, Sarbanes Oxley (SOX), and Services Organization Controls (SOC) 2. Risks from cybersecurity threats associated with the Company's use of third-party service providers are managed through vendor assessments and SOC 2 report requests, designed to ensure that our partners adhere to strict cybersecurity standards.

companyName: Genasys Inc.

ticker: GNSS


text: Our CEO regularly meets with our CIO to discuss, in part, any significant cybersecurity issues. In addition to the CIO, our Cybersecurity Team and the Information Technology Team are responsible for the day-to-day monitoring of the cybersecurity landscape, the Company's monitoring and response processes and training of Company employees. The Chief Legal Officer, Vice President of Network Strategy and VP of Network Engineering may also be involved, as necessary.

companyName: COGENT COMMUNICATIONS HOLDINGS, INC.

ticker: CCOI


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. Our IT specialist reports to our Chief Executive Officer (CEO)

companyName: Greenpro Capital Corp.

ticker: GRNQ


text: The Company maintains an Information Security Program to support the management of cybersecurity risk as an integral component of the Company's ERM framework. The Information Security Program encompasses the Company's cybersecurity policies and practices, which focus on prevention, detection, mitigation and recovery from cybersecurity incidents. In addition, as part of the Information Security Program, the Company has a Security Incident Response Policy and Plan to enable a coordinated response to protect the integrity, security and resiliency of the Company's information systems, to mitigate the risk of cybersecurity incidents and to escalate information regarding certain cybersecurity incidents to the appropriate management personnel and Board members in a timely fashion. The Information Security Program follows established industry frameworks, including the National Institute of Standards and Technology Cybersecurity Framework, and standards set by the relevant legal and regulatory authorities.

companyName: EAST WEST BANCORP INC

ticker: EWBC


text: We do not maintain a cyber incident reporting and response process and our information security policies and procedures are not reviewed have not experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations; however, there can be no guarantee that we will not experience such an incident in the future. If our limited security measures are breached and an unauthorized party obtains access to our proprietary business information, our information systems may be perceived as being unsecure, which could harm our business and reputation, and our proprietary business information could be misappropriated which could have an adverse effect on our business and results of operations. We have not implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risk.

companyName: OZ VISION INC.

ticker: UNXP


text: The Cyber Committee is informed about and monitors the prevention, detection, mitigation, and remediation of key cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants.

companyName: Kimco Realty OP, LLC


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board of Directors is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: We leverage the following guidelines and frameworks to develop and maintain our Information Security Program: Federal Financial Institutions Examination Council ("FFIEC") Information Security IT Examination Handbook, FFIEC Business Continuity Planning Handbook, FFIEC Cybersecurity Assessment Tool, the Payment Card Industry Data Security Standard ("PCI DSS"), Center for Internet Security Critical Security Controls, National Institute of Standards and Technology Special Publication 800 Series, ISO-27000 Standard and GLBA 501(b).

companyName: GREEN DOT CORP

ticker: GDOT


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Employee Matters and Managing Growth."

companyName: Cogent Biosciences, Inc.

ticker: COGT


text: Board of Directors Oversight of Cybersecurity Risks Our Board of Directors provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board of Directors receives periodic updates from the CCO, which incorporates updates provided by the Adviser regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.

companyName: Prospect Floating Rate & Alternative Income Fund, Inc.


text: Cybersecurity Expertise Our Information Security Program has been established with the mission of minimizing risk to our member, client and associate data and it is managed by our CISO. Our current CISO has over 30 years of experience in information security and technology and has held a wide variety of technical and strategic leadership positions. He holds advanced certifications including Certified Information Systems Security Professional and Certified Secure Software Lifecycle Professional.

companyName: Elevance Health, Inc.

ticker: ELV


text: Board's Oversight of Cybersecurity Risks Our Board of Directors is focused on cybersecurity. Specific responsibility for cybersecurity oversight is delegated to the Audit Committee. The Board oversees our risk management process to ensure it is properly designed, well-functioning and consistent with our overall corporate strategy. Our Audit Committee oversees the ERM process and the implementation of appropriate risk monitoring and management systems, though all Board members attend Audit Committee meetings and participate in risk management discussions. The Audit Committee also oversees risks associated with cybersecurity, financial reporting and legal matters (including data privacy, competition law, litigation and ethics and compliance).

companyName: COLGATE PALMOLIVE CO

ticker: CL


text: Our Chief Technology Officer ("CTO"), Senior Vice President of Engineering ("SVP-Engineering"), Data Engineering and Security Director and General Counsel have primary responsibility for assessing and managing material cybersecurity risks and are members of management's Security Committee, which is a governing body that drives alignment on security decisions across our company. The Security Committee meets monthly to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The Security Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies.

companyName: authID Inc.

ticker: AUID


text: Within our organization, our CIO, who reports to our CEO, oversees our cybersecurity function. Our SDIS reports to our CIO and is generally responsible for management of cybersecurity risk and the protection and defense of our network and systems, including the development and management of policies and processes to identify, contain, and investigate potential incidents and ensure recovery therefrom. Our SDIS has over 15 years of experience managing information technology and cybersecurity matters in multiple industries. The SDIS maintains Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM) certifications and holds a degree in information technology management.

companyName: APOGEE ENTERPRISES, INC.

ticker: APOG


text: We maintain a risk-based process to assess and review the cybersecurity practices of our third-party vendors, as appropriate, based on the level of access which the vendor has to critical operations, our information technology systems, and personally identifiable information.

companyName: Rapport Therapeutics, Inc.

ticker: RAPP


text: The Company's management is responsible for identifying, assessing, and managing the Company's exposure to cybersecurity risk. The Company has an internal team that is supported by security technologies, third-party experts, and threat intelligence resources in support of cybersecurity risk reduction. Our SVPIT oversees the team responsible for leading the enterprise-wide information technology strategy, policy, standards, architecture, and processes. This team includes our Information Technology Security Services Department and incorporates input from personnel from different functions, levels, and operating regions to support a high level of visibility and accountability throughout the company and to incorporate multiple vantage points on risks and potential mitigations. Our cybersecurity team also includes our Cybersecurity Operations Center, which is comprised of cybersecurity professionals and is responsible for the detection, analysis, and response to cybersecurity events, including threats and incidents, and is overseen by the Director of Cybersecurity Operations. Our Information Technology Security Services Department is responsible for overseeing the execution of cybersecurity strategy and maturing the Company's cybersecurity posture. Our SVPIT has over 20 years of experience in the IT industry, including change management, cybersecurity, and enterprise architecture. The Information Technology Security Services Department has extensive experience in cybersecurity, including graduate degrees in information security and Certified Information Security Systems Professional certifications.

companyName: SMITHFIELD FOODS INC

ticker: SFD


text: Our Associate Director, Infrastructure Operations, helps identify, assess and manage the Company's cybersecurity threats and risks. Along with our Associate Director, Infrastructure Operations, third-party service providers help identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting vulnerability assessments to identify vulnerabilities and third-party-conducted red/blue team testing and tabletop incident response exercises.

companyName: Kronos Bio, Inc.


text: Given the critical importance of cybersecurity, including data privacy, we believe we have developed a comprehensive cybersecurity program, supported by robust risk management and oversight procedures. We are committed to implementing leading data protection standards and have a comprehensive set of written policies and standards that take into account the guidance of industry-standard cybersecurity frameworks.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: Our cybersecurity risk management and strategy processes are led by our Chief Information Officer (CIO) and our Chief Information Security Officer (CISO). Our CIO and CISO are responsible for assessing and managing our material risks from cybersecurity threats and are informed about and oversee the prevention, detection, mitigation and remediation of cybersecurity incidents through their management of, and participation in, our cybersecurity risk management and strategy processes described in "Risk Management and Strategy" above. These individuals collectively have over 55 years of prior work experience in various roles involving managing information and operational technology security, cybersecurity and operational technology risk management, developing cybersecurity strategy, implementing effective information technology and cybersecurity processes and procedures, and experience in managing regulatory compliance, as well as several relevant degrees and certifications, including one individual with the Certified Information Systems Security Professional certification.

companyName: FREEPORT-MCMORAN INC

ticker: FCX


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, internal information technology audit, information technology security, governance, and risk and compliance reviews. To defend, detect, and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, and monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: COVENANT LOGISTICS GROUP, INC.

ticker: CVLG


text: Our Chief Risk, Privacy and Information Security Officer (" CISO ") leads the company's privacy, data protection and security program. An expert in cyber and data security trends, our CISO has over twenty years of experience in the data protection field, was a founding member of the Women Leading Privacy Advisory Board and former member of the Education Advisory Board for the International Association of Privacy Professionals (IAPP) and in 2023, was named a finalist for the Women in IT Awards in the Security Leader of the Year category, included in the SIA Women in Security Power Forum 100 and named a Top Global CISO by Cyber Defense Magazine. In addition, our CISO oversees teams across the company supporting our security and privacy functions of identify, prevent, detect, respond, and recover. These teams are comprised of personnel with a broad range of experience across the private and public sectors, the technology industry, and different geographic regions. Our cybersecurity teams monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and regularly report to our CISO. Our CISO reports directly to our Chief Executive Officer and is a member of the company's senior management team, and is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, and maintaining cybersecurity policies and procedures. Additionally, our CISO and Chief Compliance Officer regularly update our senior leadership team, our Nominating and Corporate Governance Committee, and the full Board, on the company's privacy and cybersecurity program, including privacy and cybersecurity risks, incidents, and mitigation strategies.

companyName: AvePoint, Inc.

ticker: AVPT


text: The Company conducts employee security awareness training and internal phishing exercises. When security issues arise, the Company conducts a prompt investigation and initiates response protocols and other measures to protect the Company and its valued employees and key stakeholders.


text: Our IT team regularly tests our controls through penetration testing, vulnerability scanning, internal compliance assessments, threat-hunting operations and attack simulation.

companyName: LENNAR CORP /NEW/

ticker: LEN


text: The Company is able to identify cybersecurity breaches through various channels, including but not limited to automated event detection alerts, reports from employees, notifications from external entities such as third-party IT service providers, and proactive threat investigations in collaboration with our external partners. Upon spotting a potential cybersecurity breach, including those involving third-party cyber events, the Company's designated incident response team outlined in the IRP adheres to the policy's protocols to investigate the suspected incident. This investigation entails determining the nature of the event (e.g., ransomware attack or breach of personal data), evaluating the severity of the incident, and gauging the sensitivity of any compromised data.

companyName: Extra Space Storage Inc.

ticker: EXR


text: Our cybersecurity risk program is integrated into our overall enterprise risk management assessment, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program. Internally, the CISO coordinates oversight of reviewing security alerts, identifying and monitoring ongoing and potential cybersecurity threats, evaluating strategic business impacts of cybersecurity threats and developing programs and initiatives to educate our employees regarding cybersecurity. The CISO also manages our Incident Response Team, which includes a team comprised of executives from various cross - functional management teams, internal technical support roles and external third - party service providers. The Incident Response Team will analyze and, as necessary, escalate cybersecurity incidents both internally and with third - party service providers based on type and severity of the specific incident.

companyName: Reservoir Media, Inc.

ticker: RSVR


text: The Chief Technology Officer of BHF (the "CTO") has overall responsibility for our information technology program, which includes the Company's cybersecurity risk management program. The Chief Information Security Officer of BHF (the "CISO") is directly responsible for the Brighthouse Financial cybersecurity risk management program, which is designed to protect and preserve the integrity, confidentiality, and continued availability of the information owned by, or in the care of, the Company. The CTO has over 25 years of information technology experience, including systems development, technology strategy, and vendor management; the CISO has over 30 years of information technology and cybersecurity risk management program management experience. Prior to joining Brighthouse Financial, both the CTO and CISO previously served in roles that involved leading and overseeing information technology and cybersecurity risk management programs at other public companies in the financial services industry. In addition, the CTO serves on a cross-departmental, management-level risk committee that oversees Brighthouse Financial's enterprise risks, including cybersecurity risks. This enterprise-level risk committee is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents.

companyName: BRIGHTHOUSE LIFE INSURANCE Co


text: Management's Role Managing Risk The Company's Chief Experience Officer is primarily responsible for assessing, monitoring and managing our cybersecurity risks. The Chief Experience Officer must ensure that all industry standard cybersecurity measures are functioning as required to prevent or detect cybersecurity threats and related risks. The Chief Experience Officer provides briefings on cybersecurity threats and related risks to our Chief Executive Officer on a regular basis.

companyName: Strive, Inc.

ticker: ASST


text: The Company's management team is responsible for implementing and managing the Company's cybersecurity risk management program. The management team regularly reviews the Company's cybersecurity risks and adjusts the program as needed. Risk data analyzed includes summary and detailed data from monitoring and protection systems along with remediation reports to ensure the constant evolution of the program.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: Cybersecurity Governance KKR's Chief Information Security Officer (the "KKR CISO") leads an information security team (the "KKR information security team") whose responsibilities include securing data from unauthorized use or access. The cybersecurity strategy and program at KKR's asset management business includes, among other things, annual employee training about cybersecurity risks and new employee onboarding about KKR's security policies.

companyName: KKR & Co. Inc.

ticker: KKR


text: Our cybersecurity committee plays an active role by meeting periodically to review the status of the Company's cyber security program and roadmap for new cybersecurity risk management initiatives. The committee oversees cybersecurity risk management by evaluating whether management has robust cybersecurity policies and procedures, regularly assessing and monitoring cybersecurity risks, and receiving regular reports on the Company's cybersecurity posture. The Cybersecurity Committee holds monthly review meetings, to discuss the status of the Company's Cybersecurity posture, plans and projects underway, and to discuss any changes in existing policies and procedures.

companyName: Aeries Technology, Inc.

ticker: AERT


text: As part of our broader risk management framework, from time to time, we seek to identify potential cybersecurity risks to our business and improve our policies and processes to address such risks. We have designed our business applications to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality reviews and communication and reporting structures, among other processes. We have an incident response plan in place that outlines containment, eradication and recovery plans in the event of a cybersecurity threat or incident.

companyName: GALECTIN THERAPEUTICS INC

ticker: GALT


text: Through these processes, we did not identify risks from current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information about these risks, please see the "Risk Factors" in this Annual Report on Form 10-K.

companyName: ETSY INC

ticker: ETSY


text: Our Board has overall responsibility for risk oversight, with its committees assisting the Board in performing this function based on their respective areas of expertise. Our Board has delegated oversight of risks related to cybersecurity to the Legal and Compliance Oversight ("LCO") Committee and the review of materiality determinations of cybersecurity incidents to the Audit Committee.

companyName: CAVCO INDUSTRIES, INC.

ticker: CVCO


text: As a key component of Polaris' Enterprise Risk Management process, Polaris' cybersecurity risk management program is designed to align with industry-standard cybersecurity frameworks and includes processes related to each of the following functions: identification, protection, detection, response, and recovery. Examples of relevant processes include steps for: assessing the severity of a cybersecurity threat; identifying the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider; implementing cybersecurity countermeasures and mitigation strategies; and remediating and escalating cybersecurity incidents using cross-functional expertise. Our cybersecurity risk management program also includes risk-based processes related to overseeing and identifying cybersecurity risks associated with the use of third-party providers, including processes related to: conducting cybersecurity assessments of third-party service providers, including cybersecurity obligations in contract with third-party service providers; and receiving and responding to notification of cybersecurity incidents of third-party service providers. Our cybersecurity team engages third-party security experts to assist with our processes for assessing, identifying, and managing risks from cybersecurity threat, including, for example, assessment of the maturity of our cybersecurity risk management program, penetration testing, employee awareness testing, phish testing, and incident monitoring and response, including conducting tabletop exercises.

companyName: Polaris Inc.

ticker: PII


text: Our management team, including our Senior Vice President of Technology, Director of Information Systems Security, and Director of Information Systems Governance Risk and Compliance, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience spans all aspects of information technology including cybersecurity, IT operations (infrastructure engineering and architecture design), and IT governance audit compliance across industries such as energy, healthcare, pharmaceuticals, and finance. Our Senior Vice President of Technology's experience includes over 30 years in technology leadership and management, with 25 years within the healthcare sector, specializing in cybersecurity programs, and establishing technology compliance programs with industry standards such as Sarbanes-Oxley, HIPAA, HITRUST, and NIST. Our Director of Information Systems Security's experience includes over 20 years in IT, with 12 years within the healthcare sector, managing risk assessments and leading security programs using the HITRUST framework to ensure compliance with HIPAA, NIST, ISO 27001, and GDPR. Our Director of Information Systems Governance Risk and Compliance's experiences includes over 25 years in IT audit and security governance, establishing and leading IT GRC programs, directing IT security initiatives, and maintaining relevant certifications including CDPSE, CRISC, and CISA.

companyName: P3 Health Partners Inc.

ticker: PIII


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of Oxford Funds and other third -party service providers. Oxford Funds manages the day -to-day operations of the Company and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Oxford Square Capital Corp.

ticker: OXSQ


text: FirstEnergy's Cyber Security Program identifies security controls and user responsibilities for the organization to identify and manage the risk of a cyber security incident. FirstEnergy also conducts various internal and external risk assessments each year. These include required annual compliance assessments, such as requirements under the Sarbanes-Oxley Act and Payment Card Industry Data Security Standard compliance audits, as well as ad-hoc assessments driven by emerging risks, changes in FirstEnergy's environment, or benchmark/roadmap needs. Risks identified in such assessments are considered for inclusion in FirstEnergy's risk portfolio, or incorporated directly into the Cyber Security Program, and are then prioritized and addressed as needed through the organization's written policies and procedures. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on FirstEnergy and others, such as vendors and customers, if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. FirstEnergy also regularly evaluates the adequacy and sufficiency of specific controls.

companyName: FIRSTENERGY CORP

ticker: FE


text: Our Internal security team in conjunction with the Chief Technology Officer (CTO) reviews current risks with a cross-functional leadership committee on a quarterly basis.

companyName: LIQUIDITY SERVICES INC

ticker: LQDT


text: Board of Directors' Responsibilities Our Board of Directors actively oversees our cybersecurity management processes, including appropriate risk mitigation strategies, systems, processes and controls. Our CISO meets with the Audit Committee of the Board of Directors and separately with the full Board of Directors at least twice annually to discuss the status of policies and procedures related to information security. Discussions with the Audit Committee and the full Board of Directors focus on any notable incidents and incident responses, updates on known or perceived cyber threats and the information security team's recent actions taken in response to such incidents and threats. In addition, our Board of Directors and the Audit Committee also receive updates from the CISO and/or our CIO on an ad-hoc or as-requested basis. Any incidents or changes to our process of identifying and responding to potential cybersecurity incidents would be included within these materials. According to our ISIRP, our Board of Directors would also be notified of any high severity incidents deemed material, simultaneously with the notification to the Disclosure Committee, and would be kept apprised of actions taken in response to such incidents.

companyName: Elanco Animal Health Inc

ticker: ELAN


text: The ERM Program works with those responsible for a given area of risk to gather, evaluate, and prioritize risk information for this assessment process through use of an enterprise risk profile document. Top risks, including those related to cybersecurity, are evaluated through a detailed risk assessment, and the risks are reexamined periodically as needed. InfoSec performs an annual refresh of an information security risk profile document as required by this process, and the results of such assessment are reported out for escalation, prioritization and reporting on an annual basis.

companyName: EQUINIX INC

ticker: EQIX


text: Incident Response and Business Continuity We maintain a formal incident response plan with clearly defined roles, responsibilities, and procedures for: Identifying a cybersecurity incident Assessing its nature and scope Minimizing and containing the impact

companyName: Guerrilla RF, Inc.

ticker: GUER


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from cybersecurity incidents in a timely manner. Our security operations team ("SOT"), which is comprised of internal security professionals and reports to the Chief Information Officer ("CIO") of SWK, has first line responsibility for our cybersecurity risk management processes as they relate to day-to-day operations. Our audit and compliance team ("ACT"), which is comprised of a team lead and the CIO, has second line responsibility and works in partnership with our executive leadership team ("ELT") and other internal teams to coordinate efforts, priorities and oversight. Our ACT assesses cybersecurity threats and risks based on probability and potential impact to key business systems and processes. Threats and risks that can cause major damage or service impact that the ACT considers high are incorporated into our overall risk management program. The ACT develops a mitigation plan for each identified high threat and risk and reports its progress with respect to mitigation of such threats and risks to the Technology Risk Management Committee, which is part of our ELT and consists of both management-level employees and members of the SilverSun board of directors; such high-level cybersecurity threats and risks are tracked as part of our overall risk management program.

companyName: QXO, Inc.

ticker: QXO


text: The goal of our cybersecurity risk management strategy is to protect the privacy, integrity and availability of our systems, information and data. Our subsidiaries are required to comply with rapidly evolving and complex PRC laws and regulations with respect to cybersecurity, data security and personal information protection. In response to the recent changes in the regulatory requirements, we have designed a data and information protection mechanism as part of our risk management process and efforts. The measures include the following main components: (i) enhancing data security technical measures by the introduction of an extended verification (EV) SSL certificate at the user information security technology implementation level, offering strong encryption technology and extended verification function, and providing security guarantee for online transactions; (ii) improving the technical level protection and the monitoring mechanism for data use, and for the data modules related to user information in the e-commerce platform system, using MD5 irreversible encryption for storage and display of information security sensitive fields; (iii) developing a complete personal information operating process and system and designating personnel for information security; (iv) developing a user information collection, storage and user rules and privacy agreement, following the "inform + express consent" model, informing users of the purpose, method and scope of information collection and use, as well as the channels for inquiring and correcting inaccuracies in information and data; (v) conducting assessments on technology, operational risks and system common issues, and data security governance; (vi) engaging a data security service organization to conduct an annual data security assessment and providing disclosure and updates to all stakeholders; (vii) establishing an emergency plan for personal information security incidents, which includes an emergency response mechanism for security incidents, incident impact assessment and mitigation measures, and emergency response training and drills; (viii) providing periodic training to employees; and (ix) promoting consumer data protection awareness. We have implemented and are in the process of implementing these measures.

companyName: Fortune Valley Treasures, Inc.

ticker: FVTI


text: Because our business involves the collection, use, storage, and transmission of personal information, we are subject to numerous federal, state, local, and foreign laws, regulations, and other obligations relating to privacy and data security. Countries around the world have adopted or are proposing similar laws and regulations relating to privacy and data security, and we may become subject to them as we expand our operations into new geographic markets. Unity Software Inc.

companyName: Unity Software Inc.

ticker: U


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CISO. With over twenty years of experience in the field of cybersecurity, our CISO brings a wealth of expertise to his role. His background includes extensive experience in all facets of information technology and information security and is well-recognized within the industry. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: In the event of a major security incident, certain members of the ISC form part of our Incident Management Team ("IMT"). The IMT follows our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership, the IEB and the Board of Directors, as appropriate.

companyName: Information Services Group Inc.

ticker: III


text: Given the size of the Company, we do not employ individuals with significant experience and relevant backgrounds in information security, cyber risk management, and cyber incident response. However, we contract with third-party vendors who have these backgrounds. These backgrounds include relevant degrees, certifications, and relevant work experience, including in roles responsible for cybersecurity oversight in entities similar to us, and our Chief Financial Officer relies on the expertise provided by these third-parties in carrying out his cybersecurity responsibilities.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM


text: In this specific regard, the Company has begun a search for a Chief Financial Officer (CFO), and will place similar recruitment emphasis on identifying a Senior Risk Officer and recruitment of additional board members who have had Board level Audit Committee experience.

companyName: I-ON Digital Corp.

ticker: IONI


text: Our Board of Directors oversees management's approach to managing cybersecurity risks. The Board of Directors is charged with overseeing the Company's risk management program, which includes cybersecurity matters. The Board of Directors routinely engages with relevant management on a range of cybersecurity-related topics, including the threat of environment and vulnerability assessments and policies and practices and receives updates on technology trends and regulatory developments from the Director of IT periodically.

companyName: FGI Industries Ltd.

ticker: FGI


text: After becoming aware of a potential cybersecurity incident, our IT Service Desk reports the incident and any pertinent information to our CISO. Our IT Service Desk is the central point of contact for reporting computer incidents or intrusions.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, may be reasonably likely to materially affect our operations and, therefore, our results of operations and/or financial condition. For more information about these risks, refer to the risk factor captioned "Cyber-attacks or a failure in our information technology and data security infrastructure could adversely affect our business and operations." in Part I, Item 1A. "Risk Factors."

companyName: AirJoule Technologies Corp.

ticker: AIRJ


text: Our CISO is responsible for assessing and managing the Company's material risks from cybersecurity threats. Our CISO has served in this role for the past four years, and has more than 25 years of experience in the aggregate in various roles involving managing information security, technology infrastructure, IT operations and developing cybersecurity strategy, and is a Certified Information Systems Security Professional (CISSP).

companyName: Evolent Health, Inc.

ticker: EVH


text: This program includes processes for triaging, assessing the severity of, escalating, containing, investigating and remediating information security events, as well as meeting legal obligations and minimizing customer impact and brand and reputational damage. In addition, we maintain insurance to protect against potential losses arising from a cybersecurity incident. Periodic tabletop exercises are conducted to test and reinforce our incident response controls, with incident severity and priority assessed on an ongoing basis.

companyName: ORACLE CORP

ticker: ORCL


text: Our program incorporates an Incident Response Plan to guide the evaluation, response, and escalation of cybersecurity incidents. This plan is overseen by our CIO and executed by a cross-functional Cybersecurity Incident Response Team. The incident response plan establishes clear protocols for incident identification, impact assessment, containment and resolution, with defined escalation paths based on incident severity. Cybersecurity incidents above a defined threshold of criticality are evaluated for materiality to determine reporting and disclosure requirements. To enhance our response capabilities, we conduct periodic assessments, including third-party reviews, and simulate incidents through regular tabletop exercises.

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI


text: We recognize the importance of identifying, assessing and managing material cybersecurity risks, including, among other things, our operations; intellectual property theft; fraud; extortion; violation of data privacy or cybersecurity laws; legal and regulatory risk; and reputational risks. We have an enterprise-wide information security program designed to secure our technology infrastructure, networks, data, products and services, and we have implemented several processes, technologies and controls to aid in our efforts to identify, assess and manage related risks. Our Chief Information Security Officer ("CISO") manages this program, in collaboration with our business and corporate teams.

companyName: MSCI Inc.

ticker: MSCI


text: We take a cross-disciplinary approach to cybersecurity and physical security. Our annual Enterprise Risk Management (ERM) process encompasses the identification and assessment of a broad range of risks, including cybersecurity, and the development and testing of controls to mitigate these risks. Our ERM assessment is designed to enable our Board of Directors to establish a mutual understanding with management of the effectiveness of our risk-management practices and capabilities, to review our risk exposures and to elevate certain key risks for discussion at the board level. Our ERM program is overseen by our chief financial officer.

companyName: ONEOK INC /NEW/

ticker: OKE


text: Training and Awareness The Company provides awareness training to its employees to help identify, avoid and mitigate cybersecurity threats. All employees with network access participate annually in required training, including spear phishing and other awareness training. The Company also periodically conducts walkthrough exercises with management and other employees to practice cyber incident response.

companyName: BANCFIRST CORP /OK/

ticker: BANF


text: The Director – Information Systems, as head of cybersecurity and in coordination with management, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response plans. Management is actively involved in the incident response and risk management process (mitigation, transference, and acceptance). Additionally, Company management meets monthly as part of the cybersecurity steering committee to direct proper activities to mitigate any risks identified.

companyName: BADGER METER INC

ticker: BMI


text: Risks from Cybersecurity Threats While we have encountered cybersecurity threats, including a breach of an administrative email account, these challenges have not resulted in the loss of any data, materials, or clinical information, and have not materially impaired our operations or financial standing.

companyName: Neuphoria Therapeutics Inc.

ticker: NEUP


text: These cybersecurity reports are provided to our Audit Committee at least annually, and these reports are delivered by our Senior Vice President and Chief Information Officer ("CIO"). Our CIO has over 30 years of experience with our information systems and is versed in cybersecurity frameworks and best practices. A security committee assists the CIO with developing controls, selecting vendor partners, identifying emerging threats and implementing best practices within our risk-based framework. Our security team is comprised of professionals with cybersecurity certifications and specialized training. The CIO addresses how we allocate capital resources to our cybersecurity processes with our executive leadership team, which includes our Chief Executive Officer, Chief Operating Officer, Chief Merchandising Officer and Chief Financial Officer. The CIO reports directly to our Chief Operating Officer.

companyName: SHOE CARNIVAL INC

ticker: SCVL


text: We provide regular updates on our cybersecurity strategic plans, programs, and initiatives to the Cybersecurity Committee of the Board of Directors at its four regularly scheduled meetings per year. Our Incident Response Plans provide for notice, and continued updates, to the Cybersecurity Committee of applicable incidents on a timely basis.

companyName: PTC INC.

ticker: PTC


text: The Company's cybersecurity management team assesses and manages the Company's material risks from cybersecurity threats through or by: active monitoring of cyber threat alerts, warnings, advisories, notices, vulnerability assessments, incident bulletins, security briefings, reports and white papers from industry and national organizations, including: downstream Natural Gas Information Sharing and Analysis Center; Electricity Information Sharing and Analysis Center; Cybersecurity and Infrastructure Security Agency; and Federal Bureau of Investigation; threat and vulnerability management; vendor security posture assessment;

companyName: UNITIL CORP

ticker: UTL


text: Cybersecurity is an area of increasing concern to management and our investors. There are two main areas involving personal data that we pay particular attention to: 1) Patient data of women enrolled in our clinical trials or commercially by overseas partners and 2) Company employee information, By design, our device and software (LuViva) are not connected to the internet. Patient results cannot be saved to the device and must first be downloaded to a flash drive and then transferred to another computer or cloud-based system to be saved. The design of our product limits our exposure to the compliance requirements of NIST 800 - 171.

companyName: GUIDED THERAPEUTICS INC

ticker: GTHP


text: The Company's cybersecurity principles, goals and targets are defined in a policy approved by the Board of Directors (the "Policy"). This Policy is anchored in a risk-based approach based on industry standards to balance the level of cybersecurity against the risks faced by the Company. Material risks are managed by both internal resources and third-party contractors, with cybersecurity risk monitoring integrated into our overall risk management program. The Company believes that effective information security management is necessary for the secured sharing and protection of information within the Company's cyberspace.

companyName: Cosmos Health Inc.

ticker: COSM


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations or reports on cybersecurity topics from our SVP Global Technology & Systems, who is our Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: BIO-RAD LABORATORIES, INC.

ticker: BIO


text: The Company utilizes widely-recognized frameworks based on practices believed to be effective for managing cybersecurity risk, including the development of an organizational understanding of systems, assets, data and capabilities, and the development and implementation of safeguards and processes designed to ensure delivery of services and to detect, respond to and recover from cybersecurity events. Significant time and resources are devoted to the protection of the Company's systems and data, including the staffing of an experienced internal cybersecurity team, the use of a variety of preventative, detective and recovery tools, and engagement with external service providers to bolster the Company's cyber defense and response capabilities. Our Chief Information Officer (CIO) has over 30 years of information technology and cybersecurity experience and our Chief Information Security Officer (CISO) has more than 15 years of direct cybersecurity experience. In addition, the Company's Internal Audit team includes members with information technology and cybersecurity expertise and training.

companyName: James River Group Holdings, Inc.

ticker: JRVR


text: Valvoline has adopted a cross-functional and multi-management level approach to assessing and managing risks arising from cybersecurity threats. The Audit Committee of the Board (the "Audit Committee") oversees the Company's enterprise risk management program. As part of this oversight, the Audit Committee has primary responsibility for overseeing risks related to cybersecurity, although the Board retains ultimate oversight over these risks. The Audit Committee reviews and discusses cybersecurity risks along with the Company's cybersecurity programs and strategy with management. The Audit Committee receives reports and presentations from the Senior Vice President and Chief Technology Officer ("CTO") and Senior Director of Information Security during bi-annual meetings, and as needed, on a range of topics including, but not limited to, the cybersecurity program and processes, information systems, business risk identification and mitigation strategies, strategic updates, operational matters, the evolving cybersecurity threat landscape, regulatory developments, and notable incidents or threats affecting the Company.

companyName: VALVOLINE INC

ticker: VVV


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

companyName: TMC the metals Co Inc.

ticker: TMC


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including, for example: incident response policy, vulnerability management policy, risk assessments, encryption of certain data, network security controls and data segregation for certain environments and systems, access controls for certain environments and systems (such as identity controls and quarterly user access reviews), physical security, systems monitoring for certain systems, vendor risk management program, system configuration standards, outfitter security awareness training, asset management, managed detection and response tools, penetration testing, cybersecurity insurance and dedicated cybersecurity staff.

companyName: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.

ticker: SPWH


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Please refer to "Item 1A. Risk factors" in this annual report on Form 10-K, including "Our business could be adversely affected by security breaches through cyber-attacks, cyber intrusions or otherwise.", for additional discussion about cybersecurity-related risks.

companyName: Kennedy-Wilson Holdings, Inc.

ticker: KW


text: The Adviser's Director of Information Technology has served in various roles in information technology and information security for 25 years, including serving as Global Technology Manager at a multi-national publicly traded broker-dealer, and 15 years as the Director of Information Technology at a privately held financial services firm. The Adviser's Director of Information Technology holds an undergraduate degree in biochemistry and has attained numerous information technology certifications over the years including Microsoft Certified Systems Engineer (MCSE) and Cisco Certified network Professional (CCNP). The Adviser's Senior Infrastructure Engineer has over 20 years industry experience, holds an undergraduate degree in radiology, and has completed various Microsoft related information technology certifications. Combined, our Adviser's information technology team has over 50 years of experience covering all major aspects of network architecture and management.

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: Cybersecurity risk management is integrated into our overall enterprise risk management program ("ERM Program") and our cybersecurity, legal, infrastructure, privacy and other cross-functional teams work together to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Cybersecurity risk management is also integrated into our broader risk management framework through information technology general controls that are independently tested by our Internal Audit team, the findings of which are reported to the Audit Committee.

companyName: Ferguson Enterprises Inc. /DE/

ticker: FERG


text: Our Audit Committee receives reports from management on our cybersecurity risks on at least a quarterly basis, and more frequently as needed. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Warby Parker Inc.

ticker: WRBY


text: The company's approach to managing risks, including cybersecurity risks, is embedded within the enterprise Operational Excellence (OE) Management System (OEMS). The OEMS provides a systematic process that enables the company to manage risk and implement safeguards and foster a culture of learning across different focus areas for Chevron's business, including cybersecurity. The company's Business Continuity Planning OE Process, a component of the OEMS, is designed to prepare Chevron to continue operations during an unplanned event or disruption, which aligns with its OE objective to prevent high-consequence security and cybersecurity incidents. Chevron works to identify critical business processes and dependent IT applications and document the processes for continuing operations without IT systems. Cross-functional teams also conduct regular multidisciplinary exercises to test and improve response plans.

companyName: CHEVRON CORP

ticker: CVX


text: Collaboration, Education, Incident Response and Recovery Planning Our key security, risk, and compliance personnel meet regularly and, together with our cybersecurity consultants, develop strategies for preserving the confidentiality, integrity and availability of data and our information technology systems and networks. We have established incident response and recovery plans to address potential cybersecurity incidents which are regularly evaluated for their effectiveness. Management maintains controls and procedures and periodically conducts tabletop exercises that are designed to ensure prompt escalation of material cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board of Directors (our "Board") in a timely manner. In addition, we regularly educate employees on the importance of maintaining the security of our information technology systems and networks and over handling and protecting customer and employee data, including through regular phishing awareness campaigns, security awareness communications, and recurring privacy and security training.

companyName: SPX Technologies, Inc.

ticker: SPXC


text: Aspire is committed to ensuring the highest standards of cybersecurity to protect our systems, networks, and data from cyber threats. We recognize the critical importance of safeguarding sensitive information and maintaining the trust of our customers, partners, and stakeholders. cybersecurity strategy is built on a foundation of proactive risk management, continuous monitoring, and adherence to industry best practices. We employ a multi-layered approach which leverages technologies to defend against evolving cyber threats.

companyName: Aspire Biopharma Holdings, Inc.

ticker: ASBP


text: Rubicon's cybersecurity program is built around the Service Organization Control Type 2 (SOC 2) standards established by the Assurance Services Executive Committee (ASEC) of the American Institute of Certified Public Accountants (AICPA). The cybersecurity program is independently assessed through the SOC 2 audit process. Additionally, we have developed and implemented a Business Continuity Management System (BCMS) which has been certified against the International Organization for Standardization (ISO) 22301:2019 standard. Rubicon's program encompasses a series of policies and controls to prevent, detect, and respond to threats and incidents. Policies and controls include, but are not limited to, identity access management, employee awareness and training, change management, privacy, continuity and resiliency, incident management, security operations, endpoint security, data classification and handling, and third-party risk management.

companyName: Rubicon Technologies, Inc.


text: Our risk management processes and procedures include a cybersecurity risk management program as part of its multiple technical layers of defense. Through our cybersecurity risk management program, we have designed and implemented processes for identifying, assessing, preventing, and managing material risks from cybersecurity threats to our critical computer networks, third-party service providers, communication systems, hardware and software, and our critical data, including confidential company and customer information. As part of our cybersecurity risk management program, we evaluate our various technical layers of defense on an ongoing basis including performing incident response planning, frequent vulnerability testing, vendor risk management, intrusion monitoring, and maintaining a security awareness program. We invest in our people, processes and systems and collaborate with appropriate government and law enforcement agencies to help monitor cybersecurity threats as well as prevent and respond to cybersecurity incidents.

companyName: Axos Financial, Inc.

ticker: AX


text: As a defense contractor, we must also comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement ("DFARS") related to adequately safeguarding controlled unclassified information ("CUI"). The Department of Defense ("DoD") will require defense contractors to comply with its CMMC program in the future. We are incorporating the requirements of the CMMC program into our overall cybersecurity program and anticipate we will be in position to meet such requirements when it becomes effective.

companyName: DUCOMMUN INC /DE/

ticker: DCO


text: Internal and external cybersecurity audits provide a third line of defense and independently provide assurance on how effectively the Company, as a whole, manages cybersecurity risk. Each year, Duke Energy Corporate Audit Services (CAS) performs various audits of key Duke Energy security systems and functions, such as third-party risk management programs, to assess whether appropriate security controls are in place and operating effectively. In addition to these internal audits, the Company is subject to a variety of external audits, performed periodically as required by the auditing entity, including external audits performed by the North American Electric Reliability Corporation under the Critical Infrastructure Protection framework (NERC CIP), Transportation & Security Administration Pipeline Security Directive and Federal Energy Regulatory Commission Dam Security.

companyName: PROGRESS ENERGY INC


text: Lastly, we leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: TRICO BANCSHARES /

ticker: TCBK


text: Engagement of Third Parties As part of the above processes, we regularly engage with assessors, consultants, and other third-parties to review our cybersecurity program. These reviews are intended to evaluate the effectiveness and robustness of the security measures implemented in our networks and information systems, identifying potential vulnerabilities, performance improvements, and recommended improvement strategies. These security assessments may focus on key areas such as user access controls, data encryption processes, auditing and monitoring of database activities, system and server configuration and update procedures.

companyName: GLAUKOS Corp

ticker: GKOS


text: Our cybersecurity program is led by our CISO, who reports to our Chief Information Officer (CIO). Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, many of whom have decades of experience and hold certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager, and through the use of technological tools and software and engagement with external consultants. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk and holds the following certifications: Certified Information Systems Security Professional (CISSP), a Certified Ethical Hacker (CEH), am FINRA Licensed (with a Series 99), and an Oracle Cloud Certified Professional (OCP). Our CISO and CIO regularly report directly to the Board, the Audit Committee and the ESG and Risk Committee on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate incidents. In addition, in the event of an incident, we intend to follow our incident response procedures that include notification processes to inform senior management and the Board of Directors and provide ongoing updates regarding any such incident until it has been remediated as appropriate.

companyName: JACOBS SOLUTIONS INC.

ticker: J


text: We have implemented an information security management system in accordance with our risk profile and business that is designed to protect us, our employees, and our shareholders from cybersecurity threats. We have also developed an incident response policy and procedure designed to facilitate the handling of cybersecurity incidents.

companyName: ORAGENICS INC

ticker: OGEN


text: Risk Management and Strategy have processes in place for assessing, identifying, and managing material risks from cybersecurity threats. Our risk management activities are overseen by senior management and are integrated into our overall enterprise risk management framework. As part of this process, management identifies and assesses internal and external cybersecurity risks and the potential impact of such risks on our business.

companyName: CITRINE GLOBAL, CORP.

ticker: CTGL


text: Under our Enterprise Risk Management (ERM) process, the Company evaluates risks to the enterprise on short, intermediate and long-term bases. The ERM Committee, a group comprised of members of senior management, meet on a regular basis to oversee the performance of these risk management functions. We assess risks using a probability-magnitude lens, with shorter and intermediate term risks generally given greater weight. We prioritize mitigating activities on shorter and intermediate term risks, but also use risk analyses and oversight to proactively incorporate mitigating activities into our long-term strategy. The ERM process reflects a Company-wide effort designed to identify, assess, manage, report and monitor enterprise risks and risk areas. This effort includes the Company's Enterprise Risk Services (Internal Audit), Sarbanes-Oxley (SOX), Compliance Audit, legal and IT security teams, among others. The identification and evaluation of cybersecurity threats and risks is integrated into this ERM process.

companyName: DAVITA INC.

ticker: DVA


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engage d by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: BOX INC

ticker: BOX


text: Our Board considers cybersecurity and other information technology risks as part of its risk management and compliance oversight function. The Board oversees management's implementation of our cybersecurity risk management processes and receives reports from management on our cybersecurity risks at least twice a year. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Board receives briefings from management on our cyber risk management processes, and it receives presentations on cybersecurity topics from our Chief Technology Officer, Chief Information Security Officer and Chief Information Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: DIGITAL REALTY TRUST, INC.

ticker: DLR


text: In accordance with our data security incident response plan, management is required to promptly update and discuss with the Audit Committee any material or potentially material cybersecurity incidents and provide an update to the Board upon determination. Management regularly updates the Audit Committee regarding incidents with lesser impact potential.

companyName: LANDS' END, INC.

ticker: LE


text: Cybersecurity risks posed by third-party vendors and service providers are integrated into the Company's risk management framework. Vendor security practices, compliance with contractual cybersecurity obligations, and exposure to cybersecurity threats related to external providers are assessed regularly. While these efforts aim to assess and mitigate cybersecurity risks, no security assessment can eliminate all potential risks associated with third-party vendors.

companyName: CHAIN BRIDGE BANCORP INC

ticker: CBNA


text: The California Consumer Privacy Act, went into effect in January 2020, and provides additional privacy rights for California residents, and in November 2020, California further expanded privacy rights for California residents by enacting the California Privacy Rights Act, which became effective January 1, 2023. Several other states have enacted similar comprehensive privacy laws. We anticipate federal and state regulators to continue to enact legislation related to privacy and cybersecurity, which may require additional compliance investments and changes to policies, procedures and operations.

companyName: OCTAVE SPECIALTY GROUP INC

ticker: OSG


text: d.conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats;

companyName: TruBridge, Inc.

ticker: TBRG


text: The CIO, in his capacity, regularly informs the Corporate General Counsel, Chief Financial Officer (CFO) and Co-Chief Executive Officers (CEOs) of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks we are facing.

companyName: Century Communities, Inc.

ticker: CCS


text: Managing Material Risks & Integrated Overall Risk Management Rhinebeck Bank has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our internal risk management team works closely with our IT department to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including ongoing education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests.

companyName: Rhinebeck Bancorp, Inc.

ticker: RBKB


text: We engage third parties, including vendors and other external service providers, to support our cybersecurity and data privacy processes such as risk assessments, program enhancements, and value-added user verification services. These third parties provide security services, including regular reviews of our security environment to provide an independent, industry-recognized risk rating and internal audits of our technology and security controls. Further, we deploy technical safeguards that are we believe are designed to help protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, endpoint detection and response, logging, monitoring and alerting, anti-malware functionality, email security, network security monitoring and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. Our third-party risk management program includes processes for identifying and managing material cybersecurity risks arising from third-party providers. The program actively engages with the enterprise-wide risk assessment process and partners with cyber risk management to report relevant risks to the IT/Cybersecurity Committee of our board of directors. Furthermore, our third-party risk management program includes cybersecurity as an aspect of its risk assessment of third parties with the objective that key risks are identified and addressed. Moreover, the program also considers risks associated with certain fourth parties, entities that are partners or subcontractors of our direct third-party vendors, through assessments carried out internally and by our third-party service providers.


text: Technology managed by third parties – We have IT systems essential to business operations managed by third parties. These systems process, transmit, store electronic information and manage or support a variety of business processes and activities. Before any engagement, we conduct holistic risk assessments of third-party providers. We scrutinize multiple dimensions of risk factors including information security, regulatory compliance and architectural design. We established monitoring procedures to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: DONALDSON Co INC

ticker: DCI


text: We have established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our senior leadership and executive team on a monthly basis. At the management level, we have established an information security risk committee, chaired by our Chief Information Security Officer ("CISO") and comprised of employees and executive management, to, among other things, coordinate and communicate the direction, current state, security risks (gaps) and governance of our information security program. Our cybersecurity program focuses in particular on the following key areas: Collaboration

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: We plan for our Chief Financial Officer to provide our Audit Committee with quarterly general risk assessment updates, which shall cover cyber risk topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Our Audit Committee is also involved in the reporting function of our incident response plan which includes communication of any cybersecurity incident that meets our reporting thresholds, as well as ongoing updates regarding any such incident, until such incident has been resolved.

companyName: Quantum-Si Inc

ticker: QSI


text: The Cooperative's Board of Directors recognizes the significance that cybersecurity has on our business, particularly the security of our member data, and is responsible for overseeing risks to the Cooperative from cybersecurity threat actors. Our operations rely party providers. These systems collect, process, transmit and retain information that may require both mandatory and voluntary data protection regimens.

companyName: Golden Growers Cooperative

ticker: GGROU


text: Our Chief Financial Officer is informed by our third-party monitoring service of any cybersecurity incidents, who will then escalate the incident to our Chief Executive Officer, if necessary. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: MetaVia Inc.

ticker: MTVA


text: We maintain a cybersecurity program, which includes processes for identification, assessment, and management of cybersecurity risks. We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify potential areas of enhancement, and develop strategies for the mitigation of cyber risks. We have implemented a process to periodically conduct security awareness training for employees.

companyName: MILESTONE SCIENTIFIC INC.

ticker: MLSS


text: We, like others in our industry, experience cybersecurity incidents and attempts to access our systems. In the event we experience an incident, we classify it based on its significance and track remediation actions and outcomes. Although we do not believe we have been materially affected by cybersecurity incidents or threats in the past, or that past incidents are reasonably likely to materially affect us, we cannot provide any assurance that we will not experience a material incident in the future. As described above, we utilize a risk-based approach to manage cybersecurity risk and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. See Item 1A. Risk Factors for additional discussion of our cybersecurity risks.

companyName: Bloomin' Brands, Inc.

ticker: BLMN


text: In addition, STEP has an Enterprise Risk Management Committee ("ERMC") composed of a number of members of senior management from operations across STEP's businesses, legal, compliance, information technology, finance, human resources and internal audit and risk. The ERMC was established to oversee and ensure the efficient and effective management of STEP's enterprise risks. Cybersecurity and significant information security matters are to be brought before the ERMC or certain of its members, and matters of primary significance are to be further escalated and reported to the StepStone Global Executive Committee and the Audit Committee of the STEP Board and the Company's Board, as appropriate.

companyName: Stepstone Private Credit Fund LLC


text: To augment internal knowledge, we have engaged a virtual Chief Information Security Officer ("vCISO") from a third-party firm that has provided IT and security services for over 17 years and utilizes industry expertise to recommend and implement best practice solutions for operational needs. The service provides a named vCISO as part of an advisory team to assess and help manage our cybersecurity program.

companyName: Dianthus Therapeutics, Inc. /DE/

ticker: DNTH


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a cybersecurity incident response policy; incident detection and response; vulnerability management processes; a disaster recovery and business continuity plan; risk assessments; encryption of certain of our data; network security controls; segregation of certain of our data; access controls; physical security; asset management, tracking and disposal; systems monitoring; vendor risk management processes; employee training; penetration testing; and cybersecurity insurance.

companyName: ARS Pharmaceuticals, Inc.

ticker: SPRY


text: Role of the Board Our Board oversees cybersecurity risk as part of our enterprise risk management strategy. The Board receives comprehensive cybersecurity updates from our President at least quarterly to inform our directors of evolving threats and regulatory developments. We undergo regular independent audits, cybersecurity risk assessments, and compliance reviews to validate our security posture, and our Audit Committee receives annual reports regarding our ongoing security measures.

companyName: INTELLIGENT PROTECTION MANAGEMENT CORP.

ticker: IPM


text: Active participation in industry-specific information sharing organizations Membership in cybersecurity forums and communities Strategic partnerships with third -party security providers who maintain current certifications and specialize in emerging threat detection and response Subscription to threat intelligence services that provide real-time updates on evolving threats Regular review and incorporation of updated guidance from organizations such as CISA, NIST, and industry regulatory bodies Engagement with cybersecurity thought leaders and experts through conferences and professional development Regular assessments of our security program against industry benchmarks and frameworks to identify improvement opportunities

companyName: Guerrilla RF, Inc.

ticker: GUER


text: Oversight and Governance Our Board of Directors oversees our enterprise risk management strategy, including our strategy on cybersecurity risks, directly and through its committees. In this respect, the Audit Committee of the Board of Directors (the "Audit Committee") oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports from Carlyle on our enterprise risk profile on an annual basis. In addition, Carlyle's Chief Information Security Officer ("CISO") leads our cybersecurity program, chairs Carlyle's Information Security Steering Committee ("ISSC"), and provides cybersecurity status reporting to our Audit Committee at least annually. The ISSC meets quarterly and ensures that cybersecurity initiatives are in alignment with Carlyle's strategic priorities.

companyName: Carlyle Secured Lending, Inc.

ticker: CGBD


text: The underlying controls and processes of our cyber risk management program are consistent with recognized practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the International Organization Standardization 27001 Information Security Management System Requirements.

companyName: LIQTECH INTERNATIONAL INC

ticker: LIQT


text: The Technology Committee meets no less than quarterly, and its purpose is to (i) assist the Board with the oversight of technology strategy and significant technology initiatives and programs, including those that can position the use of technology to drive strategic advantages and (ii) fulfill oversight responsibilities with respect to technology risk, information management and security risks (including cyber security, cyber fraud and physical security risks), and the adequacy of PNC's business recovery, resiliency and contingency plans and test results.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: We design and assess our cybersecurity risk management program based in part on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not, nor is it in any way intended to, imply that we currently or may in the future meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Immuneering Corp

ticker: IMRX


text: The VP of IT has served in various roles in information technology and information security for over 24 years, including serving as the Chief Information Security Officer of a healthcare company and a member of the cyber emergency response team at several companies. The VP of IT holds undergraduate and graduate degrees in computer science and has attained various professional certifications in cybersecurity. The NVP of Finance and the rest of the Cybersecurity Response Committee hold undergraduate and graduate degrees in their respective fields, and have over 50 years of collective experience managing enterprise risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: Dream Finders Homes, Inc.

ticker: DFH


text: As a newly public company, GRIID's Board of Directors will oversee our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. This oversight will include regular discussions on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.

companyName: GRIID Infrastructure Inc.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, our incident response policy; incident detection and response processes; a vulnerability management policy; a disaster recovery plans; risk assessments; encrypting certain data; network security controls; segregating certain of our data; maintaining access and physical controls; asset management, tracking and disposal; systems monitoring; employee training; penetration testing conducted by third parties; maintaining cybersecurity insurance; and having dedicated cybersecurity staff.

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: Depending on the type of services required, the sensitivity of the relevant IT systems and data, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. The Company conducts due diligence prior to engaging a vendor to provide services and requires the vendor to contractually commit to appropriate data protection measures, depending on the nature of the services provided. As part of the software request and vendor evaluation process, we ensure there is a secure method for transmitting data. This includes verifying that encryption is in place both in transit and at rest. Additionally, we require vendors to provide a SOC 2 Type 2 report, which we review to confirm that security controls have been audited and validated. These measures help ensure that third-party vendors maintain appropriate safeguards for handling and sharing confidential information.

companyName: D-Wave Quantum Inc.

ticker: QBTS


text: Our CISO has been a Walmart associate for over 30 years, has served in various roles in information technology and information security at Walmart for more than 20 years, and has received industry-recognized information security certifications. Our CTO, to whom the CISO reports, has served as Walmart's CTO since 2019 and prior to that had experience managing technology and other risks at several other large public companies.

companyName: Walmart Inc.

ticker: WMT


text: The Chief Administrative Officer is responsible for the appointment of the Information Security Officer. The Information Security Officer serves as the focal point for the information security program and is responsible and accountable for its implementation and monitoring, and management of the Information Security team. The current Information Security Officer has over a decade of experience in the cyber security field, including critical roles in security operations, security governance, risk, and compliance, and cyber threat intelligence. They have multiple industry leading certifications, including nine GIAC and CISSP from the ISC2 and a Master of Engineering in Cybersecurity Policy and Compliance.

companyName: Merchants Bancorp

ticker: MBIN