text: We have designated our Chief Information Officer (CIO) to implement and maintain the IRP. Our CIO has over 20 years of experience in the field of cybersecurity and is responsible for the management of our cybersecurity and data privacy program. Among other information security duties, the CIO is responsible for: • implementing the IRP, • identifying and managing an incident response team ("IRT") principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents, • coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to, appropriately escalate, make decisions regarding, and document identified cybersecurity incidents, • conducting post-incident reviews to gather feedback on identified cybersecurity incident response procedures and address any identified gaps in security measures, • providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP, and • reviewing the IRP at least annually, or whenever there is a material change in our business practices that may reasonably affect its cybersecurity incident response procedures.

companyName: KRATOS DEFENSE & SECURITY SOLUTIONS, INC.

ticker: KTOS


text: Our current management and Board do not have in-depth cybersecurity expertise. We are considering educational opportunities or consulting to address this gap.

companyName: SolarWindow Technologies, Inc.

ticker: WNDW

secItem: Item 1C


text: The Audit Committee has periodic discussions with management regarding cybersecurity risks. The Audit Committee performs an annual review of the Company's cybersecurity program, which includes a discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation.

companyName: Allied Gaming & Entertainment Inc.

ticker: AGAE


text: Board Governance and Management Prelude's Information Security Officer provides updates on information technology risks, controls and procedure, including Prelude's plans to mitigate cybersecurity risks and respond to data breaches to Prelude's executive leadership team. Our Information Security Officer has over 20 years of experience in information security and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. The Chief Financial Officer and the Chief Legal Officer report to the Chair of the Audit Committee prompt and timely information regarding any significant cybersecurity incident. The significant incident will be reported to the remaining Audit Committee members, as well as ongoing updates regarding any such incident until it has been addressed. Such incidents, as warranted, will be reviewed by the Board of Directors.

companyName: Prelude Therapeutics Inc

ticker: PRLD


text: Cybersecurity-related risk events are reported to Onity's Enterprise Risk and Compliance Committee, an executive level management committee designed to assist the Chief Executive Officer and CRCO in executing our Enterprise Risk Management Program, including with respect to cybersecurity. The Enterprise Risk and Compliance Committee provides a formal governance and oversight infrastructure for identifying and monitoring cybersecurity risks and compliance-related issues facing Onity, which includes escalation to the Risk and Compliance Committee of the Board as appropriate.

companyName: ONITY GROUP INC.

ticker: ONIT


text: Audit Committee of the Company's Board of Directors, with the assistance of the Company's Chief Financial Officer, is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters.

companyName: Next Bridge Hydrocarbons, Inc.


text: The Chief Information Officer holds an undergraduate degree in computer science and has served in various roles in information technology for over 30 years, including serving as a senior technology leader or Chief Information Officer of two public companies and two private equity-owned firms. The Chief Information Officer and Chief Financial Officer have prior experience supporting organizations that have experienced cybersecurity events and continue to learn more about the current trends and risks by partnering with third parties.

companyName: TILE SHOP HOLDINGS, INC.

ticker: TTSH


text: Our Information Security Director, in coordination with the Executive Compliance Committee, which includes our Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, our Information Security Director and the Executive Compliance Committee monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Compliance Subcommittee when appropriate.

companyName: UpHealth, Inc.


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company. The Adviser maintains a comprehensive information security policy to manage risk which details procedures such as incident response, business continuity and disaster recovery management plans, penetration testing and quarterly cybersecurity training for all employees. The Adviser (through the Staffing Agreement with the Administrator) employs a Chief Technology Officer ("CTO"), Bobby Patnaik. Mr. Patnaik has more than twenty years of experience, including fourteen years in financial services. Prior to joining Lafayette, Mr.

companyName: Lafayette Square USA, Inc.


text: AFG describes whether and how risks from identified cybersecurity threats are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition in its risk factor disclosures in Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference in this Item 1C.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG


text: The first step in our process is to identify the risks related to our data, personnel, devices, systems and facilities. In connection with this phase, we do the following: • Perform global risk assessments which include information technology risk areas including cyber and, in conjunction with this assessment, we engage leading security and technology vendors to periodically perform specific technical information technology risk assessments; • Maintain a matrix that delineates roles and responsibilities for information security supporting significant financial applications, database and networks; • Participate in various consortiums, associations and groups to share threat intelligence and collaborate with organizations across different industries to share best practices, fight cybercrime, enhance privacy, discuss new technologies, better understand the evolving regulatory environment, and advance capabilities in these areas; • Conduct mandatory information security training for all employees and regularly evaluate their information security awareness and adherence to our information security recommendations; and • Disclose our computer usage policy on our intranet and require employees to acknowledge the policy annually.

companyName: FIRST INDUSTRIAL LP


text: As discussed in more detail under the heading "Governance," the Board of Directors' oversight of cybersecurity risk management is supported by the Audit Committee of the Board of Directors (the "Audit Committee"), which regularly interacts with the Company's ERM function, the Company's Vice President of Information Technology, other members of management and relevant management committees and councils, including management's Sarbanes-Oxley & Cybersecurity Steering Committee.

companyName: TRANSACT TECHNOLOGIES INC

ticker: TACT


text: Our board of directors is ultimately responsible for the oversight of risks from cybersecurity threats and has delegated responsibility for such oversight of cybersecurity matters to the audit committee. The audit committee receives at least quarterly, or more frequently as needed, updates from the Advisor on our cybersecurity program, including measures taken to address cybersecurity risks and significant cybersecurity incidents.

companyName: Starwood Real Estate Income Trust, Inc.

ticker: SWDR


text: Cybersecurity risk management is included in NEE's, including FPL's, overall risk management program. NEE, including FPL, operates a cybersecurity program which, among other objectives, seeks to identify potential unauthorized occurrences on or conducted through the electronic information resources owned or used by NEE or FPL (information systems) that may result in adverse effects on the confidentiality, integrity or availability of its information systems or any information residing on those systems (cybersecurity threats) as well as on its operations. The cybersecurity program includes controls to reduce the risk and potential impact of a cybersecurity incident and to align its processes, controls and implemented technologies with industry standard frameworks and regulations. In addition, outside experts assess NEE's, including FPL's, cybersecurity program capabilities, technology environment and security controls to regularly evaluate effectiveness.

companyName: FLORIDA POWER & LIGHT CO


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to identify vulnerabilities and weaknesses, address cybersecurity threats and test its readiness to respond to cyber security incidents. These efforts include a wide range of activities, including threat modeling, a variety of vulnerability and configuration scans, penetration testing, audits, tabletop exercises and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness and penetration tests. The results of such assessments, audits and reviews are reported to the Audit Committee and our board of directors and to our management, and we adjust its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. Insurance: We maintain information security risk insurance coverage.

companyName: Fortinet, Inc.

ticker: FTNT


text: As of December 31, 2024, we are not aware of any risks from cybersecurity threats, or from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company. While we maintain a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors".

companyName: GRAIL, Inc.

ticker: GRAL


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Cybersecurity breaches could expose us to material liability, damage our reputation, compromise our confidential information or otherwise adversely affect our business," which disclosures are incorporated by reference herein.

companyName: Inhibrx, Inc.


text: The Senior Vice President of IT Security ("SVP of IT Security") has over 35 years of experience in the informational technology field, with 18 years of healthcare IT experience with an emphasis in IT security and computer forensics. The SVP of IT Security has operational responsibility for ensuring the adequacy and effectiveness of the company's risk management, control and governance processes, who periodically reports to the Operational Risk Committee ("ORC"), responsible for applying the policy decisions and, in coordination with the Chief Digital Officer and Chief Executive Officer, reports to the Board at least annually or more regularly at the discretion of the ORC.

companyName: LifeStance Health Group, Inc.

ticker: LFST


text: Diligence of Vendors and Other Third Parties. As noted above, the Company's information security program applies to our vendors and other third parties (referred to collectively as "vendors") with access to our information systems and networks and/or confidential and proprietary information. Before we grant access to the Company's systems or a vendor otherwise obtains access to the Company's confidential and proprietary information, our information security team assesses the vendor's information security program. We review the vendor's information security policy (to the extent the third party is willing to provide a copy of such policy), information security audits, service organization reports and similar information as well as examination reports of the vendor if available from the banking regulators or other governmental entities; the team will also investigate the background, reputation and history of prior cybersecurity incidents of such vendor or other third party. If the information security team is not satisfied that the vendor's information security infrastructure is adequate to reasonably protect the Company's systems and confidential and proprietary information from unauthorized access, and there are no suitable solution to address the information security team's concerns, then we will not engage such vendor.

companyName: RENASANT CORP

ticker: RNST


text: Board Oversight of Cybersecurity Risks The board of trustees of the Company (the "Board") provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO") regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: AGL Private Credit Income Fund


text: As of February 28, 2024, we do not believe that any past cybersecurity incidents have had, or are reasonably likely to have, a material adverse effect on the company, including our business, operations or financial condition. However, there can be no assurance that our cybersecurity processes will prevent or mitigate cybersecurity incidents or threats and that efforts will always be successful. It is possible that these events may occur and could have a material adverse effect on our business, operations or financial condition. See "Business and Operational Risks--We are increasingly dependent on the performance of our information technology systems and those of our third-party business partners and service providers" in Item 1A. Risk Factors of this Annual Report on Form 10-K.

companyName: Marathon Petroleum Corp

ticker: MPC


text: As a smaller reporting company with limited business, we currently do not have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity risks. As of the date of this report, we have not adopted an incident response plan as our only access to internet is the use of email account by large websites such as google and yahoo. Our business is managed by only one person, Mr. Umesh Patel, our Chief Executive Office, Chief Financial Officer and director and he is the person oversea our cybersecurity as well. We have a small board with two members including Mr. Patel, who will report and discuss the updates on cybersecurity matters, including material risks and threats to another non-executive director of the board.

companyName: FUSE GROUP HOLDING INC.

ticker: FUST


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology ("IT") environment and customer-facing products. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We conduct an annual assessment of our practices and standards against the NIST CSF. KULR is actively engaged with third-party specialists to update policies and institute controls that would ensure Cybersecurity Maturity Model Certification ("CMMC") level 2 compliance.

companyName: KULR Technology Group, Inc.

ticker: KULR


text: The Enterprise Security Director, in collaboration with her team, is responsible for IT/OT cybersecurity, data security, and physical security. The Enterprise Security Director identifies, evaluates, and facilitates mitigation of cyber, data, and physical security risks and reports on cybersecurity matters and risks to the ERSC and the AOC. Our Enterprise Security Director has over 26 years of experience in IT/OT cybersecurity, data security and physical security, and is a certified information system security professional. She is also a member of numerous state and national cybersecurity organizations.

companyName: WEC ENERGY GROUP, INC.

ticker: WEC


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, we prioritize and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Gamida Cell Ltd.


text: One aspect of the Company's information security program is focused on vendor selection. The Company evaluates all third-party vendors and service providers for their cybersecurity features and compliance with security requirements. Selected vendors, for example, must employ a variety of security measures to protect against unauthorized access, data breaches, and data loss. The Company remains committed to maintaining the highest standards of data security and ensuring the integrity and confidentiality of our data.

companyName: SUNation Energy, Inc.

ticker: SUNE


text: Cybersecurity Technical Safeguards We continually invest in information and cybersecurity services and technologies. Technical safeguards are designed to protect the Company's information systems from cybersecurity threats, including firewalls, continuous intrusion detection and response system(s), data leak prevention strategies, enhanced email protection software, antimalware functionality and access controls. These safeguards are evaluated and improved through periodic assessments and review of cybersecurity threat intelligence. We rely on third parties to support its cybersecurity program, including but not limited to email security management, security operations and vulnerability management.

companyName: KYNTRA BIO, INC.

ticker: KYNB


text: The Bank's Technology Steering Committee provides oversight and governance of the Bank's technology program and the information security program. Members of this committee include executive management, our Information Security Officer and Director of Technology. This committee meets monthly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. The Chief Operations Officer regularly reports summaries of key issues that would include cybersecurity incidents or other related information from the Technology Steering Committee to the Bank Board.

companyName: PEOPLES BANCORP OF NORTH CAROLINA INC

ticker: PEBK


text: On an annual basis, the Audit Committee reviews and discusses with management the Company's policies, procedures and practices with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, our Chief Financial Officer regularly briefs senior management, the Board of Directors and the Audit Committee on cybersecurity issues as part of our overall enterprise risk management program, which may include information regarding our exposure to privacy and cybersecurity risks deemed to have a moderate or higher business impact, even if immaterial to us.

companyName: Prairie Operating Co.

ticker: PROP


text: Our management team, with the assistance of our former Senior Director of Information Technology, now Consultant, and the Company's third-party information technology providers, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our former Senior Director of Information Technology's experience includes over 20 years of experience in information technology management and cybersecurity.

companyName: Q32 Bio Inc.

ticker: QTTB


text: Depending on the environment, system, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan; incident detection and response; vulnerability management policy; business continuity plan; risk assessments; implementation of security standards and certifications; encryption of data; network security protocols; data segregation; access controls; physical security; asset management, tracking and disposal; systems monitoring, vendor risk management program; employee training; penetration testing; cybersecurity insurance; and a dedicated CISO and security organization.

companyName: Fastly, Inc.

ticker: FSLY


text: The Audit Committee is responsible for ensuring management has processes in place designed to identify and evaluate cybersecurity risks to which the Corporation is exposed and implement programs to manage cybersecurity risks and mitigate cybersecurity incidents.

companyName: HNI CORP

ticker: HNI


text: Our board of directors has the ultimate oversight responsibility for the risk management process and regularly reviews issues that present particular risk to us, including those involving cybersecurity. Our board is responsible for ensuring that management has processes in place designed to identify and assess cybersecurity risks to which we are exposed and implement processes and programs designed to manage cybersecurity risks and mitigate and remediate cybersecurity threats and incidents.

companyName: OS Therapies Inc

ticker: OSTX


text: As of December 31, 2023, cybersecurity risks have not materially affected the Trust's business strategy, results of operations or financial condition. However, the Trust can provide no assurance that there will not be cybersecurity threats or incidents in the future or that they will not materially affect the Trust. For more information regarding the risks the Trust faces from cybersecurity threats, see Item 1A. "Risk Factors" included in this report.

companyName: WisdomTree Bitcoin Fund

ticker: BTCW


text: Our board, in coordination with the Audit Committee, oversees our ERM process, including the management of risks arising from cybersecurity threats. Our Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including our information security strategy, ongoing cybersecurity preparedness projects and programs, recent cybersecurity-related developments, changing regulations, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Further, our Information Security Team, consisting of Company IT staff, meets biannually with our Information Security Governance Committee to review our policies, incidents, responses and preventative measures. In addition, our Information Security Team presents a summary of information security key performance indicators quarterly to our Audit Committee.

companyName: SUTRO BIOPHARMA, INC.

ticker: STRO


text: The Company has developed and implemented an Information Security Program based on the Cybersecurity Framework (CSF) best practices and recommendations from the National Institute of Standards and Technology (NIST), applicable regulatory guidance, and other industry standards. Components of the program include a risk assessment program to identify, assess, and mitigate cybersecurity risk; a vendor management program to address third-party cybersecurity risk; and an incident response program documenting cybersecurity incident response and notification procedures. The Company's Information Security Officer (ISO) oversees the programs and reports on their statuses to management committees including the Information Security Review Committee (ISRC) and the Information Systems Steering Committee (ISSC). The ISRC approves policies, procedures, and standards for information security. It also discusses IT statistics and performance relative to information security performance standards. It reports to the ISSC. The ISSC is responsible for the Company's strategic IT plan, including information security. It reviews the adequacy and allocation of IT resources and monitors major projects and overall IT performance. The strategic plan is presented to the Board annually. The ISO has several years of professional experience in cybersecurity and vendor management, and holds multiple relevant professional certifications. The ISO provides an update to the Board of Directors on a quarterly basis. The Information Security Program is approved by the Board annually.

companyName: WESTAMERICA BANCORPORATION

ticker: WABC


text: Also as noted above, to ensure the confidentiality and integrity of data and to protect against security threats or data breaches, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and maintain and certify to a formal and comprehensive security management standard: ISO 27001:2013 Information Security Management System.

companyName: Rimini Street, Inc.

ticker: RMNI


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, business partners, and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving operational continuity and the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: FUELCELL ENERGY INC

ticker: FCEL


text: White Mountains's Information Technology ("IT") Steering Committee, which includes its Chief Information Security Officer, Chief Technology Officer and various members of senior management, as well as the senior IT leadership at each of its consolidated subsidiaries/affiliates are responsible for assessing and managing White Mountains's cybersecurity risk. These individuals include IT and cybersecurity professionals with relevant education, including degrees and/or certifications, and prior work experience. These individuals also monitor the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.

companyName: WHITE MOUNTAINS INSURANCE GROUP LTD

ticker: WTM


text: • Operational Impact: Cyber risks, such as ransomware, data breaches, and insider threats, are managed through a combination of robust Identity and Access Management (IAM), Privileged Access Management (PAM), and Application Security programs. These initiatives ensure secure access to critical systems and protect sensitive data from unauthorized exposure. • Reputational and Regulatory Considerations: With increasing regulatory oversight, the Adviser ensures compliance with industry standards and regulatory requirements, aligning cybersecurity measures with expectations from stakeholders and regulatory bodies. • Business Resilience: Through a well-defined Cyber Crisis Management Plan (CCMP) and Business Impact Analysis (BIA), the Adviser maintains a high level of preparedness, ensuring rapid response and recovery from cyber incidents.

companyName: Antares Strategic Credit Fund


text: The Committee reports quarterly to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings on our cyber risk management program.

companyName: Intapp, Inc.

ticker: INTA


text: Management's Role Managing Risk The CLCO and the COO play a pivotal role in informing the Board of Directors about cybersecurity risks. They provide comprehensive briefings to the Board of Directors, with a minimum frequency of not less than once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.

companyName: CATALYST PHARMACEUTICALS, INC.

ticker: CPRX


text: As of the date of this Report, HVII has not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that it believes have, or are likely to, materially affect it since its initial public offering.

companyName: Hennessy Capital Investment Corp. VII

ticker: HVII


text: We seek to detect and investigate unauthorized attempts and attacks against our network, products, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our products and services; however, we remain potentially vulnerable to known or unknown threats. In some instances, we, our business partners and our customers can be unaware of a threat or incident or its magnitude and effects. Further, there are increasing regulation requirements regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm.

companyName: QDM International Inc.

ticker: QDMI


text: Recognizing that humans are often the most vulnerable element of even the most secure computer architectures, The Partnership has increased the frequency and sophistication of the mandatory training and phishing campaign program for our employees. The Partnership also conducts monthly reviews of global cybersecurity incidents to ensure that appropriate mitigation measures are in place to guard against similar threats. The Partnership is committed to enhancing its organizational resilience through a multiyear, comprehensive incident response tabletop drill program. Building upon the success of the two drills conducted in 2023, we are dedicated to continuous improvement and proactive readiness in addressing potential challenges and ensuring the effective management of incidents.

companyName: Delek Logistics Partners, LP

ticker: DKL


text: Additionally, we have a Security Operations Center ("SOC") to oversee several initiatives designed to improve our cybersecurity protection, readiness and response. The Company partnered with a third party to provide Security as a Service ("SECaaS") to assist our internal SOC in reducing the likelihood and impact of a cybersecurity attack. The SOC oversees penetration testing, vulnerability scanning, intrusion prevention, endpoint and insider threat detection, log management and other cybersecurity-related projects. The Company also consulted with third parties to achieve ISO 27001 certification related to information security management, which was achieved starting in 2020 and maintained every year since.

companyName: TruBridge, Inc.

ticker: TBRG


text: The CISO works collaboratively with business and functional colleagues to implement a program designed to protect the Company's information system from cybersecurity threats and promptly respond to potential cybersecurity incidents. Multidisciplinary teams are deployed to respond to cybersecurity incidents in accordance with the Company's incident response plans. Through ongoing communication from these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and reports such incidents to the Board when appropriate.

companyName: AMERICAN INTERNATIONAL GROUP, INC.

ticker: AIG


text: Our Information Security team, led by our Vice President, Information Technology, who reports directly to our Chief Information Officer, manages our enterprise cybersecurity program and is responsible for managing all reported cybersecurity threats and addressing matters related to cybersecurity risk, information security and technology risk.

companyName: EQT Corp

ticker: EQT


text: Our management team, including our CIO, CISO and CIRO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity advisors. Our Information Technology (IT) management team collectively holds over 50 years of strategic IT and global transformational experience, including having held IT advisory roles with top-tier organizations. Each member of the team has experience operating in complex, international business environments. The IT management team has demonstrated achievement in Information Security strategy development, risk management and implementation of security and risk management programs that drive awareness, decrease exposure and strengthen organizational IT controls.

companyName: OMNICOM GROUP INC.

ticker: OMC


text: Our board of directors, with assistance from the audit committee, oversees the Company's management of risks arising from cybersecurity threats. The audit committee regularly reviews the measures implemented by the Company to help identify and mitigate risks from cybersecurity threats. As part of such reviews, the audit committee receives reports and presentations from the CIO and members of our team responsible for overseeing the Company's cybersecurity risk management, including our legal team, which may address a wide range of topics. This includes recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, compliance, privacy, technological trends and information security considerations arising with respect to the Company's peers and third parties. The audit committee also reports to the board of directors at least annually on cybersecurity matters.

companyName: Leslie's, Inc.

ticker: LESL


text: From time-to-time, the Company has identified cybersecurity threats and cybersecurity incidents that require the Company to make changes to its processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected the Company, it is possible that threats and incidents the Company identifies in the future could have a material adverse effect on its business strategy, results of operations and financial condition. Governance.

companyName: LANDMARK BANCORP INC

ticker: LARK


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. As part of this program, we have processes in place that are designed to assess, identify and manage material risks from cybersecurity threats, which are part of the Company's overall enterprise risk management process and have been embedded in the Company's operating procedures, internal controls and information systems.

companyName: Pediatrix Medical Group, Inc.

ticker: MD


text: Our CISO leads our cybersecurity risk management program. The individual currently serving in this role has over 20 years of experience designing and building cybersecurity programs, and his background spans multiple industries such as fintech, SaaS, energy/utilities, legal and managed security services. The CISO establishes and supervises procedures for the evaluation of our information systems, including the use of security tools and system reviews designed to spot potential weaknesses. The CISO works to keep up to date with the latest trends in cybersecurity, such as emerging risks and best practices for cybersecurity risk management. In case of a cybersecurity incident, the CISO initiates our incident response plan in an effort to respond to the incident and to reduce the potential damage to our organization.

companyName: MeridianLink, Inc.


text: Our personnel and members of our Board of Directors undergo mandatory periodic training on cybersecurity threats, with updated insights into effective defense mechanisms and our evolving cybersecurity policies and practices.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: Our IT team is led by the Director of Information Technology and is responsible for regular assessment and management of cybersecurity risks. The Director of Information Technology has constant access to the Audit Committee to provide regular updates as necessary regarding any new developments.

companyName: ENNIS, INC.

ticker: EBF


text: Our cybersecurity program and policies articulate the expectations and requirements with respect to acceptable use, education and awareness, security incident management and reporting, identity and access management, vendor due diligence, security (with respect to physical assets, products, networks, and systems), security monitoring and vulnerability identification. Our cybersecurity program and policies are operated by a dedicated cybersecurity operations team in conjunction with our enterprise Risk Management and Compliance program.

companyName: Global Business Travel Group, Inc.

ticker: GBTG


text: Our information security program is led by our CISO, who reports to the CIO. Our CISO organization collaborates closely with key stakeholders across the businesses, including our Security & Resiliency and other global practice organizations, in developing and implementing our cybersecurity strategy, policy, operations, threat detection and incident response and remediation. Our information security teams that support these efforts are comprised of cybersecurity professionals with many years of experience in cybersecurity across multiple sectors, including heavily regulated industries such as financial services and defense, and many of them hold relevant industry certifications.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect Registrant, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if a cyberattack disrupts Registrant's critical operations, service or financial systems. See "Information Technology Risk Factors" under Item 1A. In addition, any unauthorized access to sensitive information or data breaches could be detrimental to Registrant's operations, critical corporate information and reputation and relationships with its customers, vendors, employees, directors and could negatively affect the future of contract awards at ASUS and could result in a termination of one or more of its existing contracts or the assessment of penalties. The cost of responding to a cyberattack could be significant depending on the severity of the cyberattack and could go beyond financial costs as operations and services provided by Registrant could be delayed and coordinated resources in response could be significant. Registrant could also be assessed penalties if it is determined that applicable data privacy laws have been violated.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: Despite our efforts to improve our cybersecurity measures, there can be no assurance that our initiatives will fully mitigate the risks posed by cyber threats. The landscape of cybersecurity risks is constantly evolving, and we will continue to assess and update our cybersecurity measures in response to emerging threats. For a discussion of potential cybersecurity risks affecting us, please refer to the "Risk Factors" section.

companyName: ATLANTIC INTERNATIONAL CORP.

ticker: ATLN


text: We use managed endpoint detection and response tools to proactively monitor, detect, and respond to security threats across all endpoints, including desktops, laptops, and mobile devices. These tools provide real-time visibility into endpoint activities, allowing us to identify suspicious behavior, such as malware infections, unauthorized access attempts, and abnormal system processes.

companyName: ARGAN INC

ticker: AGX


text: The Audit Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.

companyName: Cipher Digital Inc.

ticker: CIFR


text: Operating Model—We have adopted a cross-functional operating model designed to identify, prevent, assess, manage and mitigate cybersecurity threats and incidents. We have established controls and procedures intended to promptly escalate certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by the cyber incident disclosure committee in a timely manner.

companyName: HERC HOLDINGS INC

ticker: HRI


text: As an externally managed company, we rely on Cantor's information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by Cantor.

companyName: Cantor Fitzgerald Income Trust, Inc.


text: Our cybersecurity program is designed to align with certain industry standards and best practices, such as ISO 27001 and the National Institute of Standards and Technology Cybersecurity Framework. We have a Cyber Incident Response Plan which defines roles and responsibilities in the event of a cybersecurity incident, as well as the processes for keeping the CISO, senior management, and the board of directors informed about the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Marqeta, Inc.

ticker: MQ


text: As discussed above, our cybersecurity team oversees information security, cyber and technology risk and IT compliance. As of December 31, 2023, our cybersecurity team consisted of 13 associates with an average of approximately 14 years of cybersecurity experience, all of whom hold college degrees, including three that hold a master's degree (two of which are in the field of information security), along with 52 professional certifications in aggregate. Our cybersecurity team is led by a Senior Director of Cybersecurity, who reports through one of our Vice Presidents to our Chief Technology and Innovation Officer, who is a member of the executive team.

companyName: Cable One, Inc.

ticker: CABO


text: Corporate Security Posture We periodically conduct independent security assessments to assess our corporate environment's security posture and inform where cyber security investments should be made. For systems in our corporate environment where our cloud certifications have an operational dependency, we also maintain ISO/IEC 27001 certifications relating to overall IT processes and controls and ISO 22301 certification relating to business continuity.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: We are committed to deploying recognized cybersecurity systems, methods, and best practices. ChampionX uses the National Institute of Standards & Technology Framework (NIST Framework), a toolkit to make an internal assessment of our cybersecurity capabilities and to develop priorities. We take action to assess and manage our technology and cybersecurity environment and to identify material risks from cybersecurity threats directed at our company and those associated with our use of third-party service providers, including the following: • Enterprise cybersecurity maturity assessments performed periodically by a qualified third-party entity which we use to develop a multi-year strategy, investment, and project roadmap focused on improving and enhancing the Company's security posture; • An annual cybersecurity tabletop exercise and assessment, facilitated by an independent third party, focused on testing our incident response processes and capabilities; and • Regular cybersecurity assessments of various components of our technology environment to help ensure we continuously improve and strengthen our cybersecurity posture.

companyName: ChampionX Corp


text: We have an enterprise-wide information security program designed to provide controls, technologies and other processes to identify, assess and manage material cyber and information security risks and threats. Our information security program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover.

companyName: VALLEY NATIONAL BANCORP

ticker: VLY


text: Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information we collect and store, including information regarding our customers, suppliers and employees. As part of our enterprise risk management program, we actively work to identify, prevent, and mitigate cybersecurity threats, and take steps to be prepared to effectively respond to cybersecurity incidents when they occur. Our approach includes using select third-party resources, including external cybersecurity consultants, auditors, and technologies, along with our internal staff, to benchmark, measure, and improve our cybersecurity risk management systems and processes, and ensure alignment with industry best practices.

companyName: CULP INC

ticker: CULP


text: Vendor Security. We have a vendor risk management program that works to classify service provider or business partner risk based on several factors, including but not limited to data type accessed and/or retained. Using a risk-based approach, we perform diligence and security risk assessments for certain vendors and service providers and include appropriate obligations in our contractual arrangements.

companyName: HOME DEPOT, INC.

ticker: HD


text: In addition, we have technology and information security processes, security and threat assessment plans and safeguards and periodic external service and service provider reviews in place led by our VP IT, governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the Board of Directors (including the Audit Committee chair).

companyName: Astra Space, Inc.


text: AHL's CIO has over 30 years of insurance and financial services operations and technology experience, including as chief information officer at large insurance companies, and received a Bachelor of Science in business management and a Master of Business Administration in management information systems. AHL's CISO is responsible for managing Athene's information security program. AHL's CISO has over 25 years of information technology experience and over 20 years of information security experience; is a Certified Information Systems Security Professional, a Certified Information Systems Manager; and holds a Bachelor of Arts in statistical science, a Bachelor of Science in computer science, and a Master of Business Administration in business.

companyName: Apollo Global Management, Inc.

ticker: APO


text: Our CTO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, and approving budgets. Our Senior Director, Information Security manages preparing for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: Dow also utilizes internal and external audits and assessments, vulnerability testing, governance processes over outsourced service providers, active risk management and benchmarking against peers in the industry to validate Dow's security posture. The Company also engages external firms to measure Dow's NIST CSF maturity level.

companyName: DOW INC.

ticker: DOW


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Senior Vice President of Technology and Director of Information Systems Security or other internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: P3 Health Partners Inc.

ticker: PIII


text: As a blank check company, we do not have any operations and our sole business activity has been to search for and consummate a Business Combination. However, because we have investments in our Trust Account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, the Management Team will report to the Board of Directors and provide updates on the Management Team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: Thunder Bridge Capital Partners IV, Inc.


text: Our risk management program regularly assesses third party risks (inclusive of fourth-party risk) by conducting activities to identify and mitigate risks from third parties (e.g., vendors, suppliers, and other business partners). Cybersecurity risks are evaluated when selecting and managing applicable third-parties that handle or process employee, business, or customer data, and a review process that includes due diligence over a third-party's information security and technology control environment is conducted at onboarding and periodically throughout the lifecycle of the relationship to ensure that systems of third- parties meet certain security baseline requirements. We maintain procedures to respond to, manage and mitigate third-party cybersecurity events and vulnerabilities when identified.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: Our Board has established a Technology and Information Security Oversight Committee ("TISOC") to assist the Board in providing oversight of matters pertaining to technology, information security, and privacy, including risks from cybersecurity threats; management's efforts to monitor and mitigate those risks; and significant cybersecurity incidents. The TISOC meets at least four times a year and typically receives quarterly reports from our Chief Information Security Officer ("CISO") and other members of management. Risks from cybersecurity threats are also discussed with the full Board as part of regular legal updates and management presentations, the Board's oversight of enterprise risk management, and periodic education sessions. The Board's Audit Committee also receives reports regarding information security and technology-related audits conducted by our internal audit department.

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: Cybersecurity risk management is an important part of our overall risk management efforts. We maintain a cybersecurity program that is comprised of policies, procedures, controls and plans whose objective is to help us prevent and effectively respond to cybersecurity threats or incidents. Through our cybersecurity risk management process, we continuously monitor cybersecurity vulnerabilities and potential attack vectors to company systems. We maintain various measures to safeguard against cybersecurity threats such as monitoring systems, security controls, policy enforcement, data encryption, employee training, tools and services from third-party providers and management oversight to assess, identify and mitigate risks from cybersecurity threats. We conduct regular testing of these controls and systems including vulnerability scanning, penetration testing and simulating the execution of parts of our disaster recovery plan. All employees are required to pass a mandatory cybersecurity training course on an annual basis and we regularly conduct phishing simulations to train our employees on how to recognize phishing attempts. have implemented cybersecurity frameworks, policies and practices which incorporate industry-standards and contractual requirements.

companyName: CPI AEROSTRUCTURES INC

ticker: CVU


text: Board Oversight of Cybersecurity Risks The board of directors of the Company ("Board") provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Chief Information Security Officer ("CISO") of the Investment Adviser and Chief Compliance Officer ("CCO") of the Company regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and briefing on material risks from cybersecurity threats and material cybersecurity incidents impacting the Company.

companyName: WhiteHorse Finance, Inc.

ticker: WHF


text: Our cybersecurity risk management program includes: • a security team principally responsible for managing our security controls and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Oncternal Therapeutics, Inc.


text: Our cybersecurity controls, which are the mechanisms in place to prevent, detect and mitigate threats in accordance with our policies and procedures, are based on the regulatory requirements to which we are subject and are monitored and tested both internally and externally by third parties at least annually. These controls include regular system updates and patches, employee training on cybersecurity and privacy requirements, incident reporting, and the use of encryption to secure sensitive information. In addition, we also regularly perform phishing tests of our employees and update our training plan at least annually. We maintain business continuity and disaster recovery capabilities to mitigate interruptions to critical information systems and/or the loss of data and services from the effects of natural or man-made disasters to Dexcom locations. We also provide annual privacy and security training for all employees. Our security training incorporates awareness of cyber threats (including but not limited to malware, ransomware and social engineering attacks), password hygiene, incident reporting process, as well as physical security best practices.

companyName: DEXCOM INC

ticker: DXCM


text: We also have an internal information technology audit team that routinely scans the environment and documents our compliance efforts with regulations and standards that govern our business, such as the Sarbanes-Oxley Act, the Payment Card Industry Data Security Standard (PCI-DSS), the Health Insurance Portability and Accountability Act, FERPA, and the Gramm-Leach-Bliley Act Safeguards Rule.

companyName: AMERICAN PUBLIC EDUCATION INC

ticker: APEI


text: Our IT Department updates management on cybersecurity matters, including risk assessments, security controls, incident response procedures, employee training and Third-Party Risk Management.

companyName: Super League Enterprise, Inc.

ticker: SLE


text: We have company-wide business continuity and disaster recovery plans used to prepare for multiple events, including a potential disruption in the technology on which we rely. We maintain incident response plans and playbooks to prepare for various contingencies and types of incidents. The cybersecurity incident response plan ("IRP") includes immediate actions to mitigate and contain the short-term impact of an incident, and long-term strategies for remediation and prevention of future incidents. The IRP also includes policies that dictate escalation procedures and remediation plans based on the severity level of an incident. As part of our IRP, we consider engaging third-party cybersecurity firms to assist in the event of a significant incident. We also conduct tabletop exercises to enhance incident response preparedness.

companyName: Bloomin' Brands, Inc.

ticker: BLMN


text: Review. Occurs after the event has been resolved. The priority in this phase is to review the investigation/response process and update this Plan based on the lessons learned.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: The Audit Committee of our Board oversees our cybersecurity risk program and receives regular presentations from management regarding the Company's efforts to monitor and mitigate cybersecurity risks. In addition, cybersecurity risks are reviewed by our Board, at least annually.

companyName: NCS Multistage Holdings, Inc.

ticker: NCSM


text: While the Board has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, discussing with management, and overseeing the Company's data privacy, information technology and security and cybersecurity risk exposures, including: (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation; (ii) the programs and steps implemented by management to monitor and mitigate any exposures; (iii) the Company's information governance and cybersecurity policies and programs; and (iv) major legislative and regulatory developments that could materially impact the Company's privacy, data security and cybersecurity risk exposure. On a quarterly basis, the CISO reports to the Audit Committee on cybersecurity matters, including a detailed threat assessment relating to information technology risks, the programs and steps implemented by management to monitor and mitigate exposures, the Company's information governance and cybersecurity policies and programs, and significant legal/regulatory developments that could materially impact the Company's cybersecurity risk exposure. The CISO also apprises the Audit Committee of cybersecurity incidents promptly for high priority incidents and in aggregate for low priority incidents. The Audit Committee updates the full Board concerning the Company's cybersecurity matters.

companyName: NEXTNAV INC.

ticker: NN


text: The Audit Committee of the Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyberrisks.. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. The Audit Committee and management have engaged a third-party firm to oversee the complete audit of our cybersecurity and risk management systems to ensure the integrity of the systems that are in place.

companyName: RenX Enterprises Corp.

ticker: RENX


text: We also identify, assess and manage risks associated with our use of third-party service providers and maintain a third-party risk management program that monitors third-party cybersecurity risk throughout the procurement lifecycle—from planning and sourcing through relationship conclusion. This program includes supplier cybersecurity vetting at the time of engagement, cybersecurity risk assessments and cybersecurity vulnerability monitoring. Our third-party risk management program is aligned with NIST and ISO/IEC frameworks and is focused on continuous improvement through intelligence sharing with industry groups.

companyName: BECTON DICKINSON & CO

ticker: BDX


text: We have an Incident Response Plan ("IRP") that defines and documents procedures for assessing, identifying, and managing a cybersecurity incident. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process aligns with the NIST framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all personnel (including third-party partners) that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company. We also have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Board of Directors.

companyName: Calumet, Inc. /DE

ticker: CLMT


text: At the management level, our VP of Infrastructure & Security leads the team responsible for implementing, monitoring and maintaining our cybersecurity risk management program across our business. He has extensive cybersecurity knowledge and skills gained from over 15 years of relevant work experience, including various leadership and management roles in information technology at the Company and elsewhere. He also has a Bachelor of Science in information systems.

companyName: Exodus Movement, Inc.

ticker: EXOD


text: In light of the critical importance of cybersecurity to our business, in the spring of 2023, our board of directors formed a standing cybersecurity committee. The cybersecurity committee meets quarterly and is responsible for reviewing with management our cybersecurity and other information technology risks, controls and processes, including the processes used to prevent or mitigate cybersecurity risks and respond to cybersecurity events. These reports include updates on our information security risks and threats, any notable incidents, escalations or third-party risks, the status of projects to strengthen our information security systems, assessments of the information security program, the emerging threat landscape and company security culture. The interim CISO provides reports at least quarterly to the cybersecurity committee as well as to our Chief Executive Officer, Chief Technology Officer, and other members of our senior management, as appropriate. The cybersecurity committee also receives quarterly updates from our legal department and third-party experts. Our cybersecurity committee provides regular updates to the board of directors on such reports, and coordinates with the audit committee of the board of directors with respect to any risks with implications for our financial reporting, accounting, internal controls or other matters presenting significant financial risk.

companyName: BILL Holdings, Inc.

ticker: BILL


text: Engagement of Third-Party Consultants and Assessors – In addition to our internal efforts to manage cybersecurity risks, we recognize the value of engaging third-party consultants, firms or assessors to provide specialized expertise and support in enhancing our cybersecurity posture, policies and procedures. While our internal IT staff possess valuable skills and knowledge, leveraging external resources can provide additional insights, validation and assurance in our cybersecurity initiatives.

companyName: ESCALADE INC

ticker: ESCA


text: Our CISO is responsible for hiring appropriate personnel, managing the security budget, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, providing security and security-related risk guidance to leadership relating to product management, development, and operations, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Sprinklr, Inc.

ticker: CXM


text: As part of this process, we engaged external consultants who assessed our internal cybersecurity programs and alignment with applicable practices and standards, such as the Internal Control - Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission framework. We have also retained external service providers to monitor identified risk exposures, provide ongoing recommendations and software tools for their detection and mitigation, as well as evaluating the impact and coordinating the recovery from any incidents or breaches, should they occur.

companyName: Bridger Aerospace Group Holdings, Inc.

ticker: BAER


text: We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a supplier, subcontractor or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on us. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See "Risk Factors" for a discussion of cybersecurity risks.

companyName: Canton Strategic Holdings, Inc.

ticker: CNTN


text: Our cybersecurity risk management and strategy processes are led by our Chief Financial Officer and our Vice President of Information Technology. Our Vice President of Information Technology has over 18 years of work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and has carried relevant degrees and certifications, including Certified Information Systems Auditor. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the Audit Committee of our Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, on an at least annual basis. Should a material breach be identified, as defined by the Board and the executive team, these management team members will notify the executive team and the Board and draft the required disclosure.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB


text: Our overall strategy in combatting known cybersecurity risks includes a variety of individual tactics, including: use of antivirus software, as well as other software to prevent and detect data intrusions.

companyName: Nano Nuclear Energy Inc.

ticker: NNE


text: Cybersecurity represents a critical component of our overall approach to risk management. Our cybersecurity policies, standards and practices are fully integrated into our enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board. Our cybersecurity policies, standards and practices follow recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We generally approaches cybersecurity threats through a cross-functional, multilayered approach, with specific the goals of: (i) identifying, preventing and mitigating cybersecurity threats to us; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our tenants, vendors and airport partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: Sky Harbour Group Corp

ticker: SKYH


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our internal technology systems or sensitive information, or those used by our third-party collaborators, vendors, contractors or consultants, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."

companyName: Rani Therapeutics Holdings, Inc.

ticker: RANI


text: We have established a comprehensive incident response plan to swiftly address and recover from cybersecurity incidents, minimizing operational impact. We conduct regular trainings and simulations to enhance our team's awareness and preparedness against cyber threats. Annual penetration testing and regular assessments by external experts validate the effectiveness of our cybersecurity measures. Our proactive approach to addressing identified vulnerabilities affirms the continuous improvement of our security posture.

companyName: TRANSCAT INC

ticker: TRNS


text: Our Sponsor maintains a cyber risk insurance policy, but costs related to cybersecurity threats or disruptions may not be fully insured. We acknowledge that successful cyberattacks could result in substantial costs, liability, reputational harm, and significant remediation expenses.

companyName: JLL Income Property Trust, Inc.


text: Expertise & Experience do not have any in-house cybersecurity professionals. As discussed above, our cybersecurity team consist of third-party cybersecurity professionals. Our Managed Security Service Provider has over 20 years of experience in the Cybersecurity and Energy Industry. Their leadership team has provided extensive Information Technology expertise to protect industry leaders globally. third-party cybersecurity team reports to our Chief Financial Officer.

companyName: Cyber App Solutions Corp.


text: We maintain comprehensive programs and technologies to ensure that our information systems are effective and prepared for data privacy and cybersecurity risks, including regular oversight of our security programs for monitoring internal and external threats to ensure the confidentiality and privacy of our data. As the volume and complexity of cyber-attacks continue to evolve, we continue to enhance our security capabilities by continued investment in cyber technologies, further developing our internal cybersecurity personnel and educating our workforce regarding cybersecurity, and leveraging emerging technologies.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents involving us or third-parties, that have materially affected or are reasonably likely to materially affect the Company in 2024, including its business, strategy, results of operations, or financial condition. See "Item 1A. Risk Factors - Risks Related to Cybersecurity and Privacy" for additional information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third-party providers. In the event an attack or other intrusion were to be successful, we have a response team of internal and external resources engaged and prepared to respond. We also have a cyber risk insurance policy to help us mitigate risk exposure by offsetting costs involved with recovery and remediation in the event of a successful attack or other intrusion.

companyName: KAISER ALUMINUM CORP

ticker: KALU


text: SLB has a Cyber Security Operations Center operating in three locations to provide 24/7 monitoring of its global cybersecurity environment and to coordinate the investigation and remediation of alerts. A program for staging incident response drills is in place to prepare support teams in the event of a significant incident.

companyName: SLB LIMITED/NV

ticker: SLB


text: Cybersecurity Risk As a fully integrated electric and gas utility, we operate and participate in regional markets and are interconnected with other entities. The operation of these systems depends on information technology systems we own and operate as well as third party systems and service providers. Strategic business partners are also leveraged to support our mission. As an operator of critical infrastructure, nefarious actors may find us a valuable target if they wish to disrupt our operations and negatively impact our customers. The systems and partnerships described above are all potential targets for a cyber-incident. Any significant interruption or failure of our information systems due to cyber-attacks or incidents could hinder our ability to fulfill our critical business functions. This could adversely affect our business, our financial condition, operating results or liquidity. Through the year ending on December 31, 2024, there have been no cybersecurity incidents that have had a material impact, or any impact, on our business strategy, operations, or financial condition.

companyName: NorthWestern Energy Group, Inc.

ticker: NWE


text: We are not aware of any risks from cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Although our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cybersecurity incident would not materially affect our business strategy, results of operations or financial condition. See "Risks Related to AerSale's Business and Industry—Our business could be negatively affected by cyber or other security threats or other disruptions" in Part 1, Item 1A "Risk Factors" in this Annual Report.

companyName: AerSale Corp

ticker: ASLE


text: Third-Party Risk Management—We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Redfin Corp


text: As one of the elements of the Company's overall enterprise-wide risk management approach, our Information Security Program is focused on the following key areas: • Security Operation and Governance: The Board has delegated to senior management responsibility for the Information Security Program which is managed through the IT Steering Committee, which maintains alignment and appropriate insight regarding information security activities. • Collaborative Approach: The Company has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Security Competencies: The Information Security department oversees a program of security competencies and tools designed to protect the confidentiality, integrity, and availability of our data. These assets represent a blend of various management (e.g., policies), operational (e.g., standards and processes), and technical controls (e.g., tools and configurations). • Incident Response Plan: The Company has a contracted with a third-party to provides continual security monitoring 24 hours per day, seven days per week, where resources actively deliver threat analysis, vulnerability management, intrusion detection, and intrusion hunting. The Company's Incident Response Plan helps reduce the risks related to security incidents by providing guidelines on responding to incidents. • Third-Party Risk Management: Management of the Company's third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven from risk factors established by our Risk Management program. The process provides awareness and collaboration across internal teams including, but not limited to, Information Technology, Information Security and Business Continuity. In addition to ongoing monitoring of select vendors, a review is conducted on new or significantly changed third parties, applications, and technology to ensure that systems and third parties meet certain baseline requirements. This process is used to identify and monitor risks in vendor arrangements and assists management in establishing appropriate risk responses. • Security Awareness and Education: The Company provides annual, mandatory training for personnel regarding security awareness as a means to equip the Company's personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Company's information security policies, standards, processes and practices.

companyName: FIRST BANCORP /NC/

ticker: FBNC


text: We maintain an IT and cybersecurity incident management process that provides a framework for responding to actual or potential cybersecurity incidents, engagement of third parties, including external incident response professionals, and timely reporting of incidents with a material or reasonably likely material impact to our Chief Technology Officer, Chief Financial Officer, who inform other senior management members and our board of directors as appropriate. The cybersecurity incident management process facilitates coordination across multiple areas of our organization.

companyName: Freedom Holding Corp.

ticker: FRHC


text: We have adopted an Incident Response Management Procedure (Procedure) designed to help us respond to cybersecurity incidents and mitigate our risks and impacts. An incident response team is responsible for carrying out the Procedure and is led by our Information & Technology (IT) department, and includes members from our legal and compliance, finance, and human resource departments (Security Management Team). We also manage and maintain business continuity and disaster recovery capabilities to help ensure the availability of business-critical technology resources during adverse conditions.

companyName: aTYR PHARMA INC

ticker: ATYR


text: Our enterprise risk team consists of cross-functional professionals who collaborate with subject matter specialists, as necessary, including an independent third-party expert we have retained to identify and assess material risks from cybersecurity threats, their severity, and potential mitigation steps. The CISO is primarily responsible for leading our cybersecurity risk assessment and management processes. Our Chief Business Officer, Stephen Thesing, currently serves as our CISO.

companyName: Calidi Biotherapeutics, Inc.

ticker: CLDI


text: The audit committee receives periodic reports from the Senior Vice President and General Counsel, Chief Financial Officer, Vice President, Finance and Controller concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives and has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Regulus Therapeutics Inc.


text: To continually manage and control the material risks that cybersecurity threats present to the organization, HCTI invests significantly in the cybersecurity elements outlined above.

companyName: Healthcare Triangle, Inc.

ticker: HCTI


text: A dedicated team of technology professionals works throughout the year to monitor all matters of risk relating to cybersecurity. We have begun our certification process for the globally recognized International Organization for Standardization certification for Information Security Management Systems (ISO 27001) that we expect to achieve by the second quarter of 2024. Additionally, we operate and are compliant under the following provisions: HIPAA attestation for the HIPAA Security Rule and the Health Information Technology for Economic and Clinical Health Act (HITECH) Breach Notification requirements.

companyName: JOINT Corp

ticker: JYNT


text: We are aware that there are potential cybersecurity risks associated with third-party service providers. Prior to engaging with third-party providers, Ball conducts thorough security assessments. We monitor for third-party cyber incidents and manage any third-party cyber incidents under our incident response plan and processes. Our oversight of third-party cyber risk aids our ability to lessen and mitigate impacts related to data breaches and other security incidents originating from third-parties.

companyName: BALL Corp

ticker: BALL


text: Management and Strategy regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our board of directors assesses risks based on probability and potential impact to key business systems and processes as part of our overall risk management program overseen by the board of directors. Risks that are considered high are incorporated into our overall risk management program. We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes and to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services. Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. Refer to the risk factor captioned "Cyber security risks and the failure to maintain the integrity of company, employee or guest data could expose us to data loss, litigation and liability, and our reputation could be significantly harmed." in Part I, Item 1A. "Risk Factors" for additional details regarding cybersecurity risks and potential impacts on our business.

companyName: Sintx Technologies, Inc.

ticker: SINT


text: Cybersecurity Governance Synovus' Chief Information Security Officer ("CISO"), reports to Synovus' Executive Vice President, Technology, Security, and Operations and is the head of Synovus' cybersecurity team. The CISO is responsible for assessing and managing Synovus' cyber risk management program and strategy, informing executive management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents, and supervising such enterprise-wide efforts. Synovus' current CISO has extensive information technology and program management experience with over 25 years of corporate information security experience. The CISO leads a cybersecurity team with decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes and relies on threat intelligence as well as other information obtained from governmental, public, and private sources, including external consultants retained by Synovus.

companyName: SYNOVUS FINANCIAL CORP

ticker: SNV


text: Our systems and those of our customers and third-party service providers have been and might in the future be vulnerable to cybersecurity threats. For more information about risks related to cybersecurity threats, including previous cybersecurity incidents (including the November 2021 Data Security Incident (defined below)), that have materially affected or are reasonably likely to materially affect our business, financial condition, and results of operations, see "Risk Factors–Our business could be materially and adversely affected by a cybersecurity breach or other cybersecurity incident involving our information systems or data or those of our customers or third-party or fourth-party service providers."

companyName: Robinhood Markets, Inc.

ticker: HOOD


text: The Company engages with third party cybersecurity specialists to provide an independent assessment of U. S. Steel's cybersecurity programs and to prepare a 5-year plan to maintain compliance and operational excellence. Management periodically reviews the 5-year plan and modifies it in response to changes in the threat landscape and otherwise as needed. Management employs in-depth defense mechanisms throughout the enterprise, including, but not limited to, employee training, vulnerability management, multi-factor authentication, cybersecurity insurance and table top exercises to mitigate and/or prevent cybersecurity incidents. Management also assesses the cybersecurity proficiency of potential third party cloud suppliers before utilizing their services. The assessment identifies cybersecurity-related risks and makes recommendations to enhance the security of new cloud computing services. The Company reassesses cloud suppliers on a regular interval.

companyName: UNITED STATES STEEL CORP


text: The Committee has received reports from management on our cybersecurity risks and will receive such reports on a periodic basis going forward. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Committee reports to the full Board regarding its activities which include those related to cybersecurity.

companyName: Corvus Pharmaceuticals, Inc.

ticker: CRVS


text: Our company prioritizes cybersecurity to safeguard our systems, networks, and data. Despite our efforts, we recognize the evolving nature of cyber threats and remain vigilant in addressing potential risks.

companyName: Glidelogic Corp.

ticker: GDLG


text: The Company's cybersecurity management team assesses and manages the Company's material risks from cybersecurity threats through or by: • active monitoring of cyber threat alerts, warnings, advisories, notices, vulnerability assessments, incident bulletins, security briefings, reports and white papers from industry and national organizations, including: downstream Natural Gas Information Sharing and Analysis Center; Electricity Information Sharing and Analysis Center; Cybersecurity and Infrastructure Security Agency; and Federal Bureau of Investigation; • threat and vulnerability management; • vendor security posture assessment; • Industrial Control System and Supervisory Control and Data Acquisition infrastructure cyber security protection at electric substations and natural gas plants; and • leading the Company's Cyber Incident Response Team.

companyName: UNITIL CORP

ticker: UTL


text: As of the date of this report, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in our risk factor disclosures under the heading "We rely on network and information systems and other technology, and a disruption or failure of such networks, systems or technology as a result of cyber-attacks, malware, misappropriation of data or other malfeasance, as well as outages, accidental releases of information or similar events, may disrupt our business and materially impact our results of operations, financial condition and cash flows" in Item 1A of this Annual Report on Form 10-K.

companyName: Frontier Communications Parent, Inc.


text: While we have taken significant steps to manage cybersecurity risks, there can be no assurance that these measures will prevent all potential incidents. A material cybersecurity incident could have material adverse effect on our financial condition, results of operations, or cash flows. We are committed to addressing cybersecurity risks in an ever-evolving technological landscape. Management will continue to evaluate and enhance its cybersecurity measures to adapt to emerging threats and comply with evolving regulatory requirements.

companyName: Science Applications International Corp

ticker: SAIC


text: Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or those who have access to our customer and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. Amedisys performs diligence on third parties that have access to our systems, data or that have facilities that house such systems or data and monitors cybersecurity threat risks identified through such diligence.

companyName: AMEDISYS INC


text: The nature of our business exposes us to cybersecurity threats and attacks that can lead to the unauthorized acquisition or access, compromise, loss, misuse or theft of our data, including personal information, confidential information or intellectual property. To date risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the company, including our business strategy, results of operations or financial condition. See Part 1, Item 1A, Risk Factors, in this Annual Report on Form 10-K for a discussion of cybersecurity risks.

companyName: Wayfair Inc.

ticker: W


text: Cyber partners are a key part of SLB’s cybersecurity infrastructure. SLB partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. SLB engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in SLB’s environment.

companyName: SLB LIMITED/NV

ticker: SLB


text: We also provide specialized training for employees in specialized information technology roles. We take measures to regularly update and improve our cybersecurity program, including conducting independent program assessments, penetration testing and scanning of our systems for vulnerabilities.

companyName: Renalytix plc

ticker: RNLXY


text: Notwithstanding the strength of Ohio Valley's defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date, Ohio Valley has not detected a significant compromise, significant data loss, or any material financial losses related to cybersecurity attacks, Ohio Valley's systems and those of its customers and third-party service providers are under constant threat, and it is possible that Ohio Valley could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking, and other technology-based products and services by us and our customers.

companyName: OHIO VALLEY BANC CORP

ticker: OVBC


text: The Audit Committee reports to the entire Board of Directors periodically regarding its oversight of cybersecurity matters. In developing such updates to the Board of Directors, the Audit Committee relies in large part on periodic updates from Company management. Management of Cybersecurity Matters The Company's management assumes executive responsibility for assessing, identifying, and managing cybersecurity risks and incidents.

companyName: Summit Midstream Corp

ticker: SMC


text: The executive leadership team provides oversight and guidance on cyber policies, procedures, and strategies. Our Board of Director's role in risk oversight is consistent with our leadership structure, with the executive leadership team having responsibility for assessing and managing risks we face in executing our business plans, and the Board and its committees providing oversight in connection with those efforts. In addition to the full Board, the Audit Committee of the Board plays an important role in the oversight of our enterprise risk assessment and management activities, which identify key risks to our business, including risks related to cybersecurity, data privacy, and regulations, and assesses any steps taken to monitor and control such risk. The Audit Committee regularly meets with the CISO to discuss various cybersecurity matters including cyber strategy, cybersecurity risks, controls, including results of audits, mitigation strategies, areas of emerging risks, incidents, if any, and industry trends. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported to the Audit Committee through ongoing updates until resolution.

companyName: Coupang, Inc.

ticker: CPNG