text: Our Audit Committee is encouraged to regularly engage in conversations with management on cybersecurity-related news and events and discuss any updates to our cybersecurity risk management and strategy programs. Management is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. We have processes in place to ensure that our Audit Committee shall receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Wave Life Sciences Ltd.

ticker: WVE


text: As of the time of this filing, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial conditions. Refer to "Risk Factors" in Part I, Item 1A in this Annual Report on Form 10-K under the heading "Cybersecurity breaches and other disruptions could compromise our information and expose us to liability, which would cause our business and reputation to suffer," for additional discussion about cybersecurity related risks.

companyName: SUN COMMUNITIES INC

ticker: SUI

secItem: Item 1C


text: Helios information systems organization and its management team are responsible for developing and implementing its cybersecurity policies and is comprised of individuals with either formal education in information technology or cybersecurity or relevant experience working in information technology and cybersecurity. Additionally, leaders in Helios' information technology function receive periodic training and education on cybersecurity related topics including certifications.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: Contractually obligating the provider to make us aware of significant cybersecurity related incidents; and Coordinating independent security assessments with the provider utilizing our own resources.

companyName: JBG SMITH Properties

ticker: JBGS


text: At Lucid, cybersecurity risk management is an integral part of our overall enterprise risk management program. We have made significant investments in people, processes, and technology to protect Lucid's connected vehicles, services, confidential business information, and employee and consumer personal data. We have implemented multiple and varied processes and technologies for the avoidance, identification, assessment, mitigation, and remediation of risks from cybersecurity threats and incidents designated to protect against the cybersecurity risk landscape. We are continuously assessing and enhancing our protection, detection, response, and recovery capabilities and regularly engage with the cybersecurity communities including Auto-ISAC, third-party cybersecurity and compliance partners, internal stakeholders, and organizations leading best practices, to support our goals and objectives. At its core, our cybersecurity risk management program integrates multiple teams across the organization, including our IT, digital and physical product, infrastructure, and legal teams, with leadership and oversight by executive management, the Audit Committee of the Board of Directors ("Audit Committee"), and the Board of Directors ("Board").

companyName: Lucid Group, Inc.

ticker: LCID


text: The Board of Directors receives regular reports from the Audit Committee which detail (a) InfoSec initiatives, (b) reviews of the policies and practices established to manage these processes, and (c) reviews of the Company's procedures for monitoring compliance with applicable laws. Additionally, the Board of Directors also receives updates on the Company's risks through ERM program reports, which include management's approach to mitigating and managing InfoSec risks.

companyName: INTERNATIONAL FLAVORS & FRAGRANCES INC

ticker: IFF


text: As discussed in the "Item 1A. Risk Factors – Privacy, Cybersecurity, Technology, and Data Protection Risks," we face certain ongoing risks from cybersecurity threats and recognize the critical importance of effective cybersecurity risk management in today's interconnected digital landscape. As part of our commitment to safeguarding our operations, sensitive data, and stakeholder trust, we have implemented robust cybersecurity practices and governance.

companyName: ICF International, Inc.

ticker: ICFI


text: Potential cybersecurity threats also include hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, or other security breaches. Such attacks have become more and more sophisticated over time. We expect that sophistication of cyber-threats will continue to evolve. Our processes and procedures to assess, identify and manage cybersecurity risks are overseen by an experienced, contracted resource. This resource implements cybersecurity risk mitigation strategies and activities, including the management of incident response plans, cybersecurity risks posed by third-party vendors, ensures that policies and procedures are current and followed, and reports regularly to Company's board of directors.

companyName: CQENS Technologies Inc.


text: Senior IT leaders and compliance officer are responsible for developing and implementing appropriate cybersecurity programs and ensuring our compliance with applicable laws and regulations. These leaders, equipped with relevant degrees, certifications, and extensive work experience, are informed by their cybersecurity teams about ongoing efforts to prevent, detect, mitigate, and remediate cybersecurity incidents.

companyName: Outdoor Holding Co

ticker: POWW


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The Audit Committee of the Board of Directors oversees our cybersecurity risk and receives regular reports, with a minimum frequency of once per year, from our CIO on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. Promptly after becoming aware of a material cybersecurity incident affecting our IT systems or data, the Audit Committee would work with management to formulate a mitigation plan and review compliance with such plan, as well as to ensure compliance with any external regulatory or disclosure requirements, including any disclosures of material cybersecurity breaches.

companyName: IRONWOOD PHARMACEUTICALS INC

ticker: IRWD


text: We use user access controls to limit unauthorized access to sensitive information and critical systems. In addition, we use multi-factor authentication for remote access, use of privileged accounts and access to critical systems. Encryption methods are used to protect sensitive data. This includes the encryption of customer data, financial information, and other confidential data. The implementation and management of these cybersecurity processes are integrated with the Company's overall operational risk management processes, which seeks to limit our exposure to unnecessary risks across our operations.

companyName: PERPETUA RESOURCES CORP.

ticker: PPTA


text: Our Board of Directors has overall responsibility for risk oversight and oversees the implementation and continuous improvement of our cybersecurity program and compliance with disclosure requirements. The Board of Directors receives regular reports and periodic briefings from the Chief Financial Officer on cybersecurity matters, including key risks to the Company, recent developments, and risk mitigation activities. Our cybersecurity program is overseen by the Chief Financial Officer in conjunction with a third-party service provider. The third-party service provider has the primary responsibility for the Company's cybersecurity risk management program. At the time an incident is identified, the Company completes an evaluation and summarizes the incident that is shared with the Board of Directors to effectively manage resources to reduce risk and prevent future incidents.

companyName: SMITH MIDLAND CORP

ticker: SMID


text: We recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and we have processes in place to oversee and manage these risks. We conduct annual and periodic assessments of these third-party engagements to evaluate compliance with our cybersecurity standards.

companyName: LGI Homes, Inc.

ticker: LGIH


text: Cybersecurity governance and board oversight The Board is responsible for overseeing management's assessment of significant risks facing Stewart. The Board approves management's strategy to manage these risks and monitors management's performance in implementing the strategy. The Board's oversight of cybersecurity risks occurs at both the full Board level and at the Board committee level through the Audit Committee.

companyName: STEWART INFORMATION SERVICES CORP

ticker: STC


text: The Audit Committee of Berkshire's Board of Directors has responsibility for oversight of Berkshire's cybersecurity risk management program. The Audit Committee receives periodic reports regarding the number of and impact from cybersecurity incidents reported through Berkshire's cybersecurity incident reporting process. Additionally, the Audit Committee is updated on cybersecurity trends and common deficiencies. Furthermore, the Audit Committee approves and receives updates on the workplan performed by Berkshire's internal audit group that focuses on information technology and cybersecurity risks. This includes audit procedures related to internal and external penetration testing, attack simulations, vulnerability assessments, cybersecurity program reviews and other audits designed to investigate specific risks. The frequency of these updates is determined by the Audit Committee in conjunction with Berkshire's senior management. In addition to the Audit Committee's oversight, the senior management of Berkshire's Businesses Groups are responsible for the day-to-day operations of protecting their businesses' information systems. Each Business Group is required to report significant cybersecurity events to Berkshire. Berkshire's senior management reviews incident reports to determine whether a cyber incident report should be filed with the SEC.

companyName: BERKSHIRE HATHAWAY INC

ticker: BRK-B


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats. We obtain input, as appropriate, for our cybersecurity risk management program from threat intelligence services, cybersecurity consultants, and multiple external sources. Our cybersecurity program is managed by our Head of Cyber Security, whose team is responsible for leading enterprise-wide cybersecurity strategy, risk assessment, and management policies, standards, architecture, and processes. The Head of Cyber Security has a master's degree in cybersecurity, maintains industry certifications, and has over 20 years of prior work experience in various roles involving information technology, cybersecurity, and compliance. We augment our cybersecurity team with consultants, contract resources, and managed security service providers when needed. Our executive leadership team, along with input the Head of Cyber Security, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.

companyName: OXFORD INDUSTRIES INC

ticker: OXM


text: Cybersecurity Program Overview TIAA, on our behalf, has a program and formal processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information technology ("IT") systems of TIAA and other third-party IT service providers to TIAA. TIAA and the Advisor manage our day-to-day operations and have implemented a cybersecurity program that applies to us and our operations.

companyName: Nuveen Global Cities REIT, Inc.


text: We rely on our vendors and other third parties, including the continued availability of their products and services, to conduct business and provide services to our clients. A cybersecurity incident at a vendor or other third party could materially adversely impact us. We assess third-party cybersecurity controls through a cybersecurity questionnaire and a review of independent cybersecurity rating assessments. Our contracts with third parties generally include security and privacy addendums where applicable and require counterparties to meet a specific standard of data security and to report cybersecurity incidents to us.

companyName: ASSURANT, INC.

ticker: AIZ


text: Cyberattacks are a growing geopolitical risk, becoming larger, more frequent, more intricate and more relentless. These attacks represent a significant threat to individual organizations and their ability to conduct daily operations. We rely on accounting, financial, and operational management information systems to conduct our operations. Any disruption in these systems could adversely affect our ability to conduct our business.

companyName: Ispire Technology Inc.

ticker: ISPR


text: Employees are the first line of defense against cybersecurity measures. Each employee is responsible for protecting Cullman Savings Bank and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection/prevention systems, endpoint protection, network monitoring, multi-factor authentication, and data backups. Notable services include 24/7 security monitoring and response, vulnerability scanning, third-party monitoring, and threat intelligence.

companyName: Cullman Bancorp, Inc. /MD/

ticker: CULL


text: Blackstone has a comprehensive Security Incident Response Plan (the "IRP"), designed to inform the proper escalation (including, as appropriate, to BREIT's senior management) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a Security Incident Response Team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually by our CSO and members of BXTI and Legal and Compliance.

companyName: Blackstone Real Estate Income Trust, Inc.

ticker: BSTT


text: Board Oversight of Cybersecurity Risks The Board provides oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer regarding the overall state of the cybersecurity programs of the Company's Adviser, custodian, transfer agent and Administrator, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: Muzinich BDC, Inc.


text: Ameren's board of directors maintains a standing committee, the Cybersecurity and Digital Technology Committee, which is focused on the oversight of Ameren's cybersecurity and digital technology risks. The committee has primary responsibility for oversight of cybersecurity and digital technology risk management, including the programs, policies, procedures, processes, controls and safeguards for digital technology, information security, prevention and detection of cybersecurity incidents or data breaches, and cybersecurity and digital technology matters as they relate to crisis preparedness, incident response plans, and disaster recovery and business continuity capabilities. The committee receives regular updates from the Chief Information Security Officer, the Chief Information Officer, executive management, and other members of senior management who collectively maintain the responsibility for both the execution and ongoing management of Ameren's cybersecurity program and respective initiatives. The Cybersecurity and Digital Technology Committee regularly reports on its activities to Ameren's board of directors, including reviewing and advising Ameren's board of directors of any developments it believes should be considered.

companyName: AMEREN CORP

ticker: AEE


text: Additionally, the Company has a written Information Security Policy and a Cybersecurity Incident Response Plan that provides the above-referenced processes by which such committees are informed of and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents and material risks from cybersecurity threats.

companyName: TREX CO INC

ticker: TREX


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. The Company has designed and implemented a Security Incident Response Plan for cybersecurity incidents and related processes which are overseen by management and cybersecurity professionals. Cybersecurity threats are identified and escalated to a Security Incident Response Team or member thereof pursuant to criteria set forth in these processes. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers, if any.

companyName: ALIMERA SCIENCES INC


text: Information Security Monitoring and Incident Reporting We and our Manager continuously monitor our enterprise information systems and user activity to detect anomalous activity and identify potential security related incidents. Our cybersecurity monitoring and incident reporting program is informed by NIST guidelines and is internally and externally monitored. When a potential cybersecurity incident is detected, we and our Manager gather the necessary information to classify the incident by type and severity and activate containment plans and response teams depending on the nature of the incident. Cybersecurity incidents that may impact enterprise business operations, compromise critical systems or result in unauthorized access to critical data will be escalated to the CISO and an internal incident response team comprised of senior IT, business operations and compliance personnel to coordinate any internal and external responses. The CISO and the internal incident team will also elevate any material cybersecurity incidents or unauthorized occurrences that jeopardize the confidentiality, integrity or availability of enterprise information to senior management and the board of trustees.

companyName: PennyMac Mortgage Investment Trust

ticker: PMT


text: Employee and Contractor Required Training and Awareness cybersecurity awareness training, encompassing phishing awareness and sensitive data handling, is required for all employees and contractors. In addition, all IT and IT security staff are required to complete secure coding and data hygiene training. conduct simulated phishing tests monthly with required retraining on any failures.

companyName: Health In Tech, Inc.

ticker: HIT


text: Cybersecurity Risks In 2024, we did not identify any cybersecurity threats that resulted in a material adverse effect on our business strategy, results of operations, or financial condition. Notwithstanding the discussion above and our efforts to address cybersecurity risks, we cannot guarantee that we can mitigate or eliminate all cyber-related risks, including those related to operational disruption; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; customer attrition; and reputational risks. We urge you to read our discussion regarding whether and how risks from identified cybersecurity threats could materially affect us as part of our risk factor disclosures at "Item 1A - Risk Factors"—Risks Related to Our Business and Industry" and "—Risks Related to Our Technology and Intellectual Property" of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: We have processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into our overall risk management systems and include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. We conduct security assessments of certain third-party providers before engagement and have established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Mobile Infrastructure Corp

ticker: BEEP


text: Management reviews and approves the Company's cybersecurity policies and procedures and communicates these policies and procedures to all employees to ensure adherence to established security protocols.

companyName: DallasNews Corp


text: We have not experienced cyber-attacks or other malicious activities that materially disrupted our business. Any future failure or disruption of our information technology infrastructure and communications systems or those of third parties that we use in our operations could harm our business. We describe whether and how risks from identified cybersecurity threats, including, but not limited to, as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: Hughes Satellite Systems Corp


text: LivaNova's CISO has a Master of Science in Accountancy with a specialization in risk management, in addition to over 15 years of experience in the IT Risk Advisory sector. The CISO leads the Company's information security team, identifies cybersecurity threats, and implements countermeasures in the cybersecurity realm, considering both internal operations and the external landscape. As part of his duties, the CISO provides relevant information to the CRO in their regular discussions. The CISO also manages the Company's ISMS program. Guided by the principles of various industry-leading standards, such as the NIST cybersecurity framework and ISO 27001, the objective of the ISMS program is to continue to strengthen LivaNova's cyber resiliency in connection with its information systems.

companyName: LivaNova PLC

ticker: LIVN


text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. For example, in 2020, several domestic and foreign security agencies announced that government actors or government-affiliated actors were specifically targeting organizations, like us, engaging in COVID-19 vaccine development and research. For more information, see Item 1A Risk Factors, "Security breaches and other disruptions to our information technology systems or those of the vendors on whom we rely could compromise our information and expose us to liability, reputational damage, or other costs."

companyName: NOVAVAX INC

ticker: NVAX


text: During the period covered by this Annual Report, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors—Risks Related to Market Events and Regulatory Developments—We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information" for a discussion of risks related to cybersecurity.

companyName: PGIM Private Credit Fund

ticker: PGIM


text: Our Board of Directors retains overall responsibility for oversight of cybersecurity risks. Once formed, we intend to formally delegated this oversight function to the audit committee, which will receive regular reports from management regarding cybersecurity risk assessments, monitoring activities, and incident response planning. We intend to update the audit committee as frequently as warranted by material developments, but in no event less often than annually.

companyName: VERDE RESOURCES, INC.

ticker: VRDR


text: The Southern Company system also employs systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider, or customer or otherwise implicating the third-party technology and systems used. Among other things, the Southern Company system has established a Vendor Security Incident Working Group to address such third-party security incidents, including following up with the third party as appropriate and taking steps to mitigate any impact to systems. The Vendor Security Incident Working Group includes members of the internal cybersecurity teams to address any incidents that may invoke the CIRP. Additionally, the Southern Company system typically imposes contractual obligations on vendors and other third-party business partners related to privacy, confidentiality, and data security based on their access to the Southern Company system's data and systems. The Southern Company system also maintains insurance coverage for cyber incidents; the scope of coverage and fitness of coverage is evaluated each year.

companyName: SOUTHERN CO GAS


text: The Company's Board of Directors oversees the overall risk management process, including cybersecurity risks, directly and through its committees. Our Audit Committee is responsible for the oversight of cybersecurity risks, including our assessment of potential vulnerabilities and threats, evaluation of incidents, and monitoring of the implementation of key actions and/or projects to further enhance our ability to detect and manage ongoing security threats. Key members of management, including our security officer, provide updates to our Audit Committee on at least a semi annual basis. In addition to committee updates, our security officer also meets with the full Board of Directors at least annually to discuss the Company's overall risk profile and associated ongoing mitigation efforts. The briefings provided to our Audit Committee and Board of Directors include updates on the Company's key cyber risks and threats, the status of projects to strengthen our information security systems and incident readiness programs, assessments of the information security program and our key assets, as well as the emerging threat landscape.

companyName: IonQ, Inc.

ticker: IONQ


text: While the Board of Directors, through the Risk and Compliance Committee, maintains oversight of cybersecurity risks, management is primarily responsible for identifying, assessing, and managing these risks within our broader risk management program. The Enterprise Risk Management Committee, composed of senior executives, monitors governance, risk, and compliance enterprise-wide, including cybersecurity. Management has adopted specific policies and procedures to monitor and mitigate cybersecurity threats including an incident response program, led by the CISO and staffed by professionals with diverse expertise. Incidents meeting pre-established thresholds are escalated to management for threat assessment, mitigation, remediation, and, if necessary, disclosure to clients, third-parties, and regulators.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: The Board of Directors, through its Risk Assessment ("RAC") and Technology ("TEC") Committees, (together the "Committees") provides direction and oversight of both the enterprise risk management and information/cybersecurity risk management programs. The Committees meet monthly to review and discuss overall state, current developments, management and performance metrics, risk identification and mitigation status, and new initiatives associated with both the Enterprise Risk Management and Information/Cybersecurity Programs. The Committees rely upon various management level committees (e.g.

companyName: FLAGSTAR BANK, NATIONAL ASSOCIATION

ticker: FLG


text: On at least a quarterly basis, the CISO delivers a detailed report to the full Board on data protection and cybersecurity matters. Topics covered by these reports include, but are not limited to, risk identification and management strategies, cybersecurity strategy and governance structure, consumer data protection, the Company's ongoing risk mitigation activities, learnings from data security incidents of peer companies, results of third-party assessments and testing, updates on annual associate training and other specific training initiatives.

companyName: Sally Beauty Holdings, Inc.

ticker: SBH


text: Through policy, practice, and contract (as applicable), require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care;

companyName: Byrna Technologies Inc.

ticker: BYRN


text: A cross-functional team of senior leadership assesses potential material risks to the business and the Company's ability to meet strategic priorities, including risks from cybersecurity threats. The Company's senior leadership receives updates from relevant functional heads or other subject matter specialists on these potential material risks as well as the processes or other steps being taken to manage or mitigate the risks. The team includes senior leaders in areas of importance to Company priorities, including the Company's Chief Privacy Officer, who is also our Senior Vice President of Information Technology and the Chief Legal Officer. The Company's senior leadership assesses and prioritizes risk based on impact to shareholders, operations, and strategic priorities, among other factors.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO


text: Our President and Chief Executive Officer, Senior Vice President, Chief Financial Officer and Treasurer, and Senior Vice President, General Counsel and Corporate Secretary work collaboratively with the MSP to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with a written information security incident response plan that we have adopted. These members of our management team, together with the MSP, will monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and will report such threats and incidents to the Audit Committee when appropriate.

companyName: CTO Realty Growth, Inc.

ticker: CTO


text: The Bank's Technology and Operations Committee membership consists of members of the Bank's leadership including the Bank's CIO, CISO, other information technology and information security leadership, and leadership representatives from the Bank's operational risk, information security, information technology, operations, and other departments throughout the Bank.

companyName: Federal Home Loan Bank of New York


text: Management is responsible for assessing and managing our material risks from cybersecurity threats. Management has primary responsibility for our overall cybersecurity risk management program and supervises both the internal cybersecurity personnel and external cybersecurity consultants. The Company's Information Systems Manager has many years of experience leading cybersecurity oversight and has extensive experience with information technology, including security, auditing, compliance, systems, and programming.

companyName: Digital Brands Group, Inc.

ticker: DBGI


text: We also have a counterintelligence and insider threat program to detect potential external and internal threats, conducted by purposeful or unwitting actors. As a government contractor, we must comply with extensive cybersecurity regulations, including the Defense Federal Acquisition Regulation Supplement ("DFARS") related to adequately safeguarding controlled unclassified information ("CUI") and reporting cybersecurity incidents to the DoD. The policies and implemented controls reflect our adherence to these requirements and have been assessed by external organizations, including industry partners and the federal government.

companyName: L3HARRIS TECHNOLOGIES, INC. /DE/

ticker: LHX


text: Premier maintains an Information Technology Incident Response Policy and an Information Security Incident Response Playbook that together coordinate the identification, reporting and escalation, containment, and remediation responses of any potential information security incident. Each cybersecurity incident is reviewed by the Chief Information Security Officer ("CISO") to determine if the matter needs escalated to the Company's Information Response Team, Information Security Oversight Committee ("ISOC"), Enterprise Risk Management Committee ("ERMC"), or the Board of Directors or Board-level Risk Committee.

companyName: PREMIER FINANCIAL CORP


text: The Board of Directors is responsible for overseeing overall risk management for the Company. The Audit Committee receives reports from the CISO regarding the cybersecurity program. The presented topics include, but are not limited to, the status of ongoing cybersecurity initiatives, incident reports and compliance with industry standards. Members of the Board of Directors also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: Dine Brands Global, Inc.

ticker: DIN


text: Cybersecurity risk management is integrated into our Enterprise Risk Management ("ERM") Program, which is our approach to identifying, assessing, prioritizing and mitigating risks to the Company, with mitigation efforts focused on the highest risks. Our ERM Program assesses risks, including those related to cybersecurity, annually, and monitors such risks on an ongoing basis.

companyName: Xylem Inc.

ticker: XYL


text: Our cybersecurity risk management processes are integrated as part of our overall enterprise risk management processes. Our Audit Committee conducts its oversight of our cybersecurity risk management as part of its oversight of our enterprise risk management policies and procedures. In addition, we conduct an annual survey of over 150 Ingredion business leaders across multiple functions and geographic locations that asks them to evaluate the potential severity and likelihood of cybersecurity matters, among other enterprise and information technology risks. We solicit their views on information and data security protection against cyber and internal threats, reliability of systems including disaster recovery related to malware or other cyber threats, and system implementation failures, and use the responses to modify our risk mitigation strategies accordingly.

companyName: Ingredion Inc

ticker: INGR


text: Our IT Security Team reviews security logs daily, and performs quarterly audits of device access, building access, outages, application access, and IT & Development tickets. We employ data loss prevention policies to enforce HIPAA rules and also use stringent encryption controls. In addition, a Vulnerability Scanning system performs vulnerability detection on a quarterly basis. An independent third-party company conducts annual penetration and vulnerability detection as well.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: Collaborative Approach. The Company has implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt identification and escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Ulta Beauty, Inc.

ticker: ULTA


text: Risk Management & Strategy Our cybersecurity program includes policies and procedures designed to protect our systems and operations as well as sensitive information and data from anticipated cybersecurity threats. This program is a key component of our approach to enterprise risk management.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: The legal and regulatory environment regarding information security, cybersecurity, and data privacy is dynamic and has strict requirements, including for the use and treatment of personal data, particularly in the cannabis industry where regulatory scrutiny is heightened. Complying with current or contemplated information security, cybersecurity, data protection, and data processing laws and regulations (including reporting and disclosure regimes), or any failure to comply, could cause us to incur substantial costs, require changes to our business practices, and expose us to litigation and regulatory risks, each of which could adversely affect our reputation, results of operations, and financial condition. Additionally, as our business model centers on data analytics derived from authentication activities, any limitations on our ability to collect, analyze, or monetize this data could significantly impact our revenue potential and growth trajectory.

companyName: GROOVY COMPANY, INC.


text: In the ordinary course of our business, we collect, use, store, and transmit digitally confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes using the cybersecurity risk framework published by the National Institute of Standards and Technology ("NIST") designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a dedicated information technology team, which is led by our Senior Vice President, Operations and our Vice President, Information Technology ("IT"), and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. Specific measures include regular penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments. We conduct due diligence on and audits of key technology vendors, contract research organizations (CROs), and other third-party contractors and suppliers. Additionally, we conduct periodic employee training that covers cyber and information security, among other topics. We also regularly consult with outside advisors and experts. Their assistance helps us assess, identify, and manage cybersecurity risks, anticipate future threats and trends, and understand their potential impact on our risk environment.

companyName: Spyre Therapeutics, Inc.

ticker: SYRE


text: We have established comprehensive incident response ("IR") and recovery plans and continue to periodically test and evaluate the effectiveness of those plans. Our IR plan provides our team with strategies for how to respond to incidents appropriately.

companyName: Skillz Inc.

ticker: SKLZ


text: The CISO is responsible for assessing, implementing, and monitoring our Information Security Program and cybersecurity controls, and works closely with the CIO and the CRO in managing our Information Security Program. Our CISO is a Certified Information Security System Professional with over 20 years of technical and cybersecurity leadership experience, including with large financial services companies. The CISO maintains a dedicated cybersecurity staff comprised of certified security professionals with expertise in various disciplines including threat detection, governance risk and compliance, security architecture and engineering, incident response, and third-party risks. Our CISO regularly updates our management-level Enterprise Risk Management Committee concerning cybersecurity risks and the effectiveness of our risk management efforts. The Enterprise Risk Management Committee is composed of members of executive management.

companyName: PACIFIC PREMIER BANCORP INC


text: Our Company Board plays a role in overseeing risks associated with cybersecurity threats. The Audit Committee of the Board has been delegated specific responsibility for overseeing the Company's risk management of cybersecurity. The Audit Committee has appointed a member of the Audit Committee to receive certified cybersecurity training so he can provide specialized guidance to the Board and Company.

companyName: Utz Brands, Inc.

ticker: UTZ


text: We have adopted processes, guided by the Center for Internet Security (CIS) Cybersecurity Framework, designed to identify, assess and manage material risks from cybersecurity threats. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations. We have implemented controls, such as Multi-Factor Authentication (MFA) and endpoint detection and response (EDR) solutions, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. Furthermore, we maintain a formal, Incident Response Plan (IRP) and conduct mandatory, ongoing security awareness training for all employees. Although, to date, we have not experienced a material cybersecurity incident resulting in a significant interruption of our operations, the scope of any future incident cannot be predicted with any meaningful accuracy. See "Item 1A. Risk Factors" for more information.

companyName: PHOTRONICS INC

ticker: PLAB


text: We have established and maintained comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: STORE CAPITAL LLC


text: Recognizing the risks associated with third-party service providers, we implement processes to manage these risks. We conduct assessments of critical third-party providers before engagement and maintain ongoing monitoring to assess compliance with our cybersecurity standards. In addition, we require SOC 1 Type II attestations from those IT vendors whose applications or cloud infrastructure handle sensitive information.

companyName: TREACE MEDICAL CONCEPTS, INC.

ticker: TMCI


text: In order to respond to the threat of security breaches and cyber-attacks, Prudential Financial has developed an information security program designed to protect and preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company. This information security program provides for the coordination of various corporate functions and governance groups, including global technology, risk, legal, compliance and corporate audit, and serves as a framework for the execution of responsibilities across businesses and operational roles. Among other things, the information security program establishes security standards for our technological resources and includes training for employees, contractors and third-parties. Employees with access to our Company's systems are subject to comprehensive annual training on responsible information security, data security, and cybersecurity practices and how to protect data against cyber threats.

companyName: PRUCO LIFE INSURANCE CO


text: Committee reports to the Board regarding its activities, including those related to cybersecurity. The Board also receives briefings from management on our cybersecurity risk management program.

companyName: Alset Inc.

ticker: AEI


text: Board of Directors Our board of directors, in coordination with the audit committee of our board of directors, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our audit committee regularly receives reports and presentations from the Technology Team regarding cybersecurity. The Technology Team also reports to our board of directors at least annually on cybersecurity matters. We plan to establish protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, are reported to our board of directors and/or our audit committee.

companyName: Techpoint, Inc.


text: Additionally, we maintain a comprehensive incident response plan (the "Incident Response Plan"), which establishes a comprehensive, effective and repeatable process for identifying, escalating and responding to cybersecurity incidents. We test and evaluate the Incident Response Plan, including contingency and recovery plans, on a regular basis, and we develop, implement and review contingency and recovery plans for information systems, both internal and vendor managed. The results of such assessments drive changes and enhancements to governance, policies, procedures, technologies and partner decisions to continuously monitor and improve our cybersecurity risk management. The Information Security Council practiced the procedures of the Incident Response Plan through a tabletop exercise facilitated by external consultants in October 2023, and a similar exercise is planned for the Board during 2024. We also leverage third-party support, including vendors, consultants and assessors, to analyze risk exposure, to identify remediation opportunities and to reduce our overall cybersecurity risk.

companyName: Atmus Filtration Technologies Inc.

ticker: ATMU


text: Our management team, including our CEO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: Cuentas Inc.

ticker: CUEN


text: Our CIO's experience includes over twenty years of experience in risk management and compliance, incident response, crisis management and security architecture and technology integration. Our Cybersecurity Engineer is a certified information systems security professional by the International Information System Security Certification Consortium, and his experience includes cybersecurity architecture, engineering and administration together with the development of cybersecurity policies, practices and training.

companyName: COGENT COMMUNICATIONS HOLDINGS, INC.

ticker: CCOI


text: Implementation of Regular and Mandatory Employee Training and Awareness Programs: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: POTBELLY CORP

ticker: PBPB


text: Our Board of Directors oversees and guides our business and oversees our exposure to major risks. As stated in its charter, our Board of Directors has delegated to the Audit Committee the responsibility for Board-level oversight of cybersecurity risk. As part of its oversight role, the Audit Committee receives reports about our protocols, material threats or incidents and other developments related to cybersecurity. When these discussions occur, Board members with cybersecurity acumen that are not on the Audit Committee are present and active in those discussions.

companyName: SHOE CARNIVAL INC

ticker: SCVL


text: Our management team is responsible for oversight and administration of our cyber risk management protocol, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. RetinalGenix' management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes and relies on threat intelligence as well as other information obtained from governmental, public, or private sources.

companyName: RetinalGenix Technologies Inc.

ticker: RTGN


text: WisdomTree Inc.'s cybersecurity risk management program is designed to be aligned with its business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational and financial risk.

companyName: WisdomTree Bitcoin Fund

ticker: BTCW


text: In 2024, our global cybersecurity function was maintained in our Chief Information Office, led by our Chief Information Officer (CIO), who reported to our CEO. In 2025, we have brought together our chief information and digital transformation offices into a newly formed Chief Information and Digital Office, led by our Chief Information and Digital Officer (CIDO), who reports to the CEO. The Chief Information Security Officer (CISO), who previously reported to the CIO, now reports to the CIDO and continues to lead our cybersecurity functions. The CISO is responsible for the assessment and management of cybersecurity risk and the resiliency, protection and defense of our networks and systems. The CISO leads a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, data protection, privacy, insider threats and regulatory compliance. The current CISO is an executive with extensive technical and operational experience in building and leading cybersecurity and resiliency teams in the industry and government.

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: Material Cybersecurity Risks, Threats & Incidents Although we have experienced actual and attempted cybersecurity threats and incidents in the past, we do not believe that the risks from any of these events or incidents, individually or in the aggregate, have materially affected our business, operations or financial condition, or are reasonably likely to have such an effect. However, due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. For a more detailed discussion of the risks we face see the discussion set forth under "Item 1A. Risk Factors" in this Report.

companyName: Xylem Inc.

ticker: XYL


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity program.

companyName: Beauty Health Co

ticker: SKIN


text: Our ability to conduct our business may be impaired, or our customer and employee personal information may be vulnerable, if our IT resources are compromised, degraded, damaged or fail. Such events may include, but are not limited to: a virus or other harmful circumstance; intentional penetration or disruption of our information technology resources by a third party; natural disaster; hardware or software corruption or failure or telecommunications system failure; service provider error or failure; intentional or unintentional personnel actions (including the failure to follow our security protocols); or lost connectivity to our networked resources. We prioritize cybersecurity and consumer data privacy. Our IT department is responsible for coordinating the protection of our information systems and the data they maintain.

companyName: Meritage Homes CORP

ticker: MTH


text: Risk Management and Strategy S&T's Information Security Program provides policies, procedures, controls and technical measures to assess, identify and manage material cybersecurity risks. The Information Security Program is a part of S&T's overall Enterprise Risk Management, or ERM Program. The Information Security Program is designed to achieve the following objectives: a. Protecting data through the use of automated and manual processes; b. Periodically assessing and updating the program to address an evolving threat environment;

companyName: S&T BANCORP INC

ticker: STBA


text: AVD's Board of Directors maintains oversight of cybersecurity planning, response and reporting as follows. The Lead Director, Scott Baskin, who also serves as Chair of the Risk Committee and member of the Audit Committee, is Cybersecurity Liaison to AVD's management team. The Chair of the CPRSC reports on cybersecurity preparedness, issues and incidents to the Cybersecurity Liaison regularly. Through this reporting structure, the cybersecurity team has direct interaction with the highest level of the Board and with both the Risk and Audit Committees. Cyber risk has been a subject of regular review and discussion at the Risk Committee for several years. With the advent of the CPRSC, the delineation of governance and responsibility has become that much more focused.

companyName: AMERICAN VANGUARD CORP

ticker: AVD


text: Our use of third parties in the conduct of our business is significant (including suppliers, CROs, CDMOs, and other service providers, and a cybersecurity incident at third party could materially adversely impact us. We assess third party cybersecurity controls prior to engaging such third parties and include security and privacy addendums to our contracts where applicable. We also require that third party service providers or partners report cybersecurity incidents to us so that we can assess the impact of the incident on us.

companyName: Gain Therapeutics, Inc.

ticker: GANX


text: We administer our cybersecurity risk management framework separately from our other risk management systems and processes, under the direct oversight of our board of directors and senior management. MicroStrategy's management, including our CIO and CISO, provides the board of directors with regular updates on cybersecurity incidents and emerging threats. The board actively engages with management on the development and implementation of cybersecurity policies and practices, offering insights and guidance. Board members with significant experience in software technology, such as Michael J. Saylor and Leslie J. Rechan, each with over 30 years of software industry experience, and Phong Le, our Chief Executive Officer, contribute their expertise to our cybersecurity risk management.

companyName: Strategy Inc

ticker: MSTR


text: Potential information security incidents are identified in a number of ways, including, but not limited to: users reporting security violations, system weaknesses, violations of our Information Security Acceptable Use Policy, which addresses the boundaries of acceptable use of our information technology assets, automated system alerts, and monitoring of both system generated and manually generated logs. Our Information Security Program mandates that any potential information security incident response begin at the initial internal communication and investigation stage, during which such events undergo initial investigation for validation, including related to the scope and depth of such incident and to ensure that it has not resulted from a false positive. Internal communications regarding the potential incident occur with the relevant security coordinator according to our Incident Response Procedures.

companyName: FIVE STAR BANCORP

ticker: FSBC


text: Our Information Security organization, which is headed by our Chief Information Security Officer, has primary responsibility for assessing and managing our cybersecurity risks. Our Chief Information Security Officer is the member of our management team who is principally responsible for overseeing the company's cybersecurity risk management program.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: In addition, our Chief Information Officer, who has more than 40 years of industry experience and over 20 years of experience with the development, training and controls of effective global enterprise cybersecurity programs, oversees the implementation and compliance of our cybersecurity program and mitigation of information security related risks. Such oversight includes (i) reviewing our enterprise risk register, (ii) maintaining adequate processes to manage the identified risks under our cybersecurity program, (iii) regularly analyzing logs of cybersecurity threats and vulnerabilities and (iv) overseeing prevention, detection, mitigation and remediation efforts in general, including the development and maintenance of the above-mentioned incident response plan. Additionally, we maintain an experienced information technology team at the employee level that supports our Chief Information Officer in implementing our cybersecurity program and internal reporting, security and mitigation functions.

companyName: Transocean Ltd.

ticker: RIG


text: To help manage risk from potential cybersecurity threats, as part of the annual Code of Business Conduct and Ethics training, all Company employees receive data protection and privacy training, which focuses on the need to appropriately protect and secure confidential Company information. Additionally, the Company provides annual security awareness training that covers a broad range of security topics. The Company also provides regular targeted training on topics such as phishing and secure application development, among others. In addition to online training, employees are provided with cybersecurity related information through a number of different methods, including event-triggered awareness campaigns, recognition programs, security presentations, intranet articles, videos, system-generated communications, email publications and various simulation exercises.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: Company's cybersecurity program is managed by the Vice President ("VP") of Information Systems, who has been employed by the Company for 21 years and has over 36 years of total experience in information systems. The VP of Information Systems has an extensive career in software development and infrastructure management including working with Fortune 500 companies in his prior positions. The VP of information Systems is a participant in the overall Company strategic process and has aligned the program to best service the strategic objectives of the business.

companyName: PERMA FIX ENVIRONMENTAL SERVICES INC

ticker: PESI


text: We also understand the importance of collecting, storing, using, sharing, and disposing of personal information in a manner that complies with all applicable laws. To facilitate compliance with those laws, we have privacy policies in place regarding our treatment of customer data in both our offline and online environments, as well as policies relating to the protection of employee and vendor data. Our policies provide explanations of the types of information we collect, the rationale for such collection, how we use and share information, and generally describe the measures we take to protect the security of that information. Our policies also describe how customers may initiate inquiries and raise concerns regarding the collection, storage, sharing and use of their personal data.

companyName: Bally's Corp

ticker: BALY


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: Meta Platforms, Inc.

ticker: META


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents and threats to management members, including the CFO, depending on the circumstances. The CFO, Executive Director of IT, and Vice President of Finance work with our incident response team in an effort to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management policies include reporting to the Audit Committee of the Board for certain cybersecurity incidents.

companyName: Tvardi Therapeutics, Inc.

ticker: TVRD


text: In particular, our Audit Committee is responsible for monitoring compliance with legal and regulatory requirements, in addition to considering and discussing guidelines and policies to govern the process by which risk assessment and mitigation is undertaken.

companyName: Atlas Lithium Corp

ticker: ATLX


text: Third Party Risk Management: We strive to proactively manage third party risks to minimize any adverse effects on our business that may arise due to a cybersecurity incident affecting third party systems and vendors. Although we rely on third party vendors to manage and maintain their own cybersecurity defense programs, we continue to improve on our vendor risk management program to assess our exposure to these external cybersecurity risks, including the use of external security rating services and by evaluating vendor responses to our cybersecurity questionnaire.

companyName: ANAPTYSBIO, INC

ticker: ANAB


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional service firms (including legal counsel), threat intelligence services, and cybersecurity consultants. The material cybersecurity threats identified through these processes are managed by our CISO and are escalated to senior management and our risk and compliance committee, in each case where appropriate. Together, they identify responsive actions for inclusion in our annual strategic planning, or earlier resolution depending on the nature of the risk.

companyName: Snap Inc

ticker: SNAP


text: The Company has established processes to assess, identify, and manage material risks from cybersecurity threats as part of its overall enterprise risk management system. Its cybersecurity processes include security monitoring and detection through third-party vendors. The processes also extend to oversight and identification of risks associated with vendors and customers if their computer systems interface with the Company's information systems. Upon detection of a potentially material cybersecurity incident, the Company initiates its cyber incident procedure to investigate, contain, and remediate the incident.

companyName: UPEXI, INC.

ticker: UPXI


text: Our Chief Information Security Officer is responsible for strengthening and continuously monitoring the effectiveness of our cybersecurity program. The individual currently serving in the role of Chief Information Security Officer has over 30 years of information systems and cybersecurity experience within complex and international business verticals such as technology, financial services, biotech, and other scientific organizations. He also holds the Certified Information Systems Security Professional (CISSP) certification. In addition, our cybersecurity steering committee assists in managing certain technical aspects related to cybersecurity. Our cybersecurity steering committee is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through monthly meetings and frequent communications. Regular members of the steering committee consist of participants from the IT infrastructure, Business Systems, AI and Modelling and Scientific Computing teams. Participants from other teams attend on an as-needed basis.

companyName: LanzaTech Global, Inc.

ticker: LNZA


text: Mr. Srinivasan has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and report any findings and recommendations, as appropriate, to the full Board of Directors for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the designated member of the Board of Directors.

companyName: WRAP TECHNOLOGIES, INC.

ticker: WRAP


text: The Company describes risks related to cybersecurity threats that could materially impact its business strategy, results of operations or financial condition under the heading "Risk Factors." Material impacts could include loss of access to systems and data, financial costs and reputational harm, among others.

companyName: OPENLANE, Inc.

ticker: OPLN


text: Our Board of Directors (the "Board") is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on the Company's risks, risk management process and the risk trends related to cybersecurity at least annually, which includes a review of key performance indicators, recent threats and the Company's management of such threats. The Audit Committee specifically assists the Board in its oversight of risks related to cybersecurity. The Security Director and IT Director brief the Audit Committee on information security and cybersecurity annually and as necessary in response to certain incidents.

companyName: IPG PHOTONICS CORP

ticker: IPGP


text: First Solar maintains a cyber risk management program designed to identify, assess, and manage cybersecurity risks. The underlying controls of the cyber risk management program incorporate recognized best practices and standards for cybersecurity, including guidance from the National Institute of Standards and Technology ("NIST") cybersecurity framework. Our cyber risk management program includes various risk assessments that are completed on a regular basis, including (i) information security controls assessments with internal and external audit partners, (ii) architectural and technical assessments with third-party experts, (iii) internal and external penetration testing with third-party service providers, (iv) continuous cyber risk register reviews, and (v) risk prioritization with our executive officers. The identification of cybersecurity risks is aided by a technical toolset as well as threat hunting and counterintelligence services provided by third-party service providers. These risk assessments and the technical toolset inform our information security roadmap, which allocates resources toward strategic initiatives to mitigate, transfer, and/or reduce cybersecurity risks. Our associates receive cybersecurity awareness communications, engage in annual cybersecurity training, and are exposed to periodic phishing simulation exercises with targeted training. Additionally, confidential information protection training is regularly provided to associates who have access to personally identifiable information, reside in certain jurisdictions, or have privileged access.

companyName: FIRST SOLAR, INC.

ticker: FSLR


text: As part of our cybersecurity program, we provide regular training on our information security policies and standards to help further prevent, detect and mitigate cybersecurity risks. We require mandatory cybersecurity, privacy and information handling training for all new associates upon onboarding and annually thereafter for all associates. We also conduct regular training throughout the year for our associates, as well as third-party contractors, on cybersecurity topics. We conduct training on phishing, social engineering and general cybersecurity awareness. To validate the effectiveness of our training, simulated phishing campaigns are conducted periodically for all associates. Additionally, third party software vendors and service providers who have access to our data or systems are obligated to adhere to our information security policies and standards as part of their service agreements.

companyName: Cable One, Inc.

ticker: CABO


text: Enbridge's management is responsible for the implementation of risk management strategies and monitoring performance. The technology and information services (TIS) function is centralized under the Senior Vice President & Chief Information Officer (CIO). We also engage independent third parties to assess our cybersecurity program, track their recommendations, and use those to further improve the program. Reporting to the CIO is the Chief Information Security Officer who is in charge of our cybersecurity program and oversees the 24x7x365 Security Operations Center (SOC).

companyName: ENBRIDGE INC

ticker: ENB


text: Members of our audit committee are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions and other relevant matters.

companyName: LISATA THERAPEUTICS, INC.

ticker: LSTA


text: Cybersecurity is one of the cornerstones of our strategic business plan and the driving force behind our digital transformation journey. As a financial institution, we confront a spectrum of cyber threats, ranging from common attacks like ransomware to sophisticated, organized assaults by nation-state actors. These risks extend to our customers, shareholders, suppliers, and partners, emphasizing the critical need for a robust cybersecurity stance. In light of these challenges, maintaining resilience in our cybersecurity posture is not just a priority but a fundamental necessity to safeguard our operations, performance, and maintaining customer confidence in our banking services.

companyName: BayCom Corp

ticker: BCML


text: Our Vice President of Operations, who has over 30 years of experience in IT and marketing, works with our board of directors to manage our cybersecurity policies and processes, including those described in the "Risk Management and Strategy" section above. Together, they stay informed and manage how we identify, address, prevent and resolve cybersecurity issues and related matters. They also track how we prevent, identify, lessen, and address cybersecurity issues. This is done through regular checks of our systems, tests to identify security weaknesses, and maintaining an incident response plan. In addition to such regular system checks, our Vice President of Operations, together with the board, regularly discuss active, emerging and potential cybersecurity risks. They keep each other informed about significant changes affecting cybersecurity, and they periodically update management with these changes, as well as our cybersecurity risks, so that management can administer its oversight function as a part of its broader oversight and risk management.

companyName: FOCUS UNIVERSAL INC.

ticker: FCUV


text: The Board has delegated oversight of the Company's management of cybersecurity risk to the Compliance and Risk Committee (the "Committee"). Directors with experience in cybersecurity are appointed to this Committee to assist in developing strategies and processes for protecting against, responding to, and remediating information security breaches. Those directors are Dennis Chookaszian, Patrick Gross and Leslie Thornton. The Committee reviews information security matters quarterly. In addition, the full Board regularly receives updates on cybersecurity matters from our Chief Information Officer, David C. Czeszewski, at each board meeting. The Chief Information Officer reports on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, an assessment of the information security program, and the emerging threat landscape. Mr. Czeszewski has a Bachelor of Arts degree in business and computer studies and a Master in Business Administration. He has worked in the technology field since 1986, joined the Company in 2001, and has been its Chief Information Officer since 2013.

companyName: PERDOCEO EDUCATION Corp

ticker: PRDO


text: We seek to continually strengthen our cybersecurity defenses through significant investments in resources and maintaining comprehensive cybersecurity insurance coverage. We maintain an insider threat detection program to proactively identify and mitigate both external rely on certain third-party service providers to assist us with the delivery of our products to our customers. A cybersecurity incident at a supplier or subcontractor could materially adversely impact us. Therefore, we evaluate third party providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture through a questionnaire. However, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: Our organizational objectives are aligned to address our cybersecurity risks and management plays a pivotal role in assessing and managing our material risks from cybersecurity threats. Management's role in assessing and managing material cybersecurity risks includes various management positions and committees responsible for assessing such risks. Our internal processes require escalation of material cybersecurity risks to our executive leadership and Charter's Board of Directors, as well as management and committees who are tasked with the prevention, detection, mitigation and remediation of cybersecurity incidents. These processes provide guidance for consistent and effective incident handling and response and set standards for internal notifications and escalations, as well as external notification considerations with respect to a cybersecurity event or incident requiring disclosure or notification to a state and/or federal agency or affected customers.

companyName: CHARTER COMMUNICATIONS, INC. /MO/

ticker: CHTR


text: The Bank's Incident Response and Business Continuity Programs are inclusive of cyber resiliency, business continuity and disaster recover strategies to help mitigate the impact of a cybersecurity incident across all business lines.

companyName: FLUSHING FINANCIAL CORP

ticker: FFIC


text: The Company's information security program is managed through an effective enterprise-wide cybersecurity strategy, policies, standards, architecture, and processes. The Company is committed to compliance with the International Organization for Standardization's recognized cyber incident and cyber risk management frameworks. We are dedicated to cybersecurity and maintaining the trust and confidence of our customers and stockholders.

companyName: Columbia Financial, Inc.

ticker: CLBK


text: We have established policies and procedures for assessing, identifying, and managing material risk from cybersecurity threats. We monitor cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that we use through third party providers that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Empery Digital Inc.

ticker: EMPD


text: Presidio Property Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Company has not, to date, experienced cyber incidents in the normal course of its business, nor have prior cybersecurity incidents had a material adverse effect on the Company's business, financial condition, results of operations, or cash flows. For more information about the cybersecurity risks we face, see the risk factor entitled "Risks related to cyber-attacks, cyber intrusions and other security breaches" in Item 1A- Risk Factors.

companyName: Presidio Property Trust, Inc.

ticker: SQFT


text: As part of the cybersecurity program, our information systems are monitored by automated tools and the Information Technology team. We have adopted an Incident Response Policy, which outlines the procedures we believe are necessary to identify, investigate, contain, communicate, respond, remediate and recover from a security incident. This Incident Response Policy is overseen by our Vice President of Infrastructure and Security ("VP Infrastructure") along with the Incident Response team, which may consist of members from legal, human resources, finance or other functions, if necessary. The Incident Response Policy provides organizational and operational structure, processes, and procedures to our personnel so that employees can respond to incidents that may affect the function and security of our IT assets, information resources, and business operations. We conduct periodic information security awareness training for employees and provide related educational materials.

companyName: MARZETTI CO

ticker: MZTI


text: Our CISO reports cybersecurity-related matters twice annually to the audit committee, and promptly reports any significant cybersecurity developments or incidents to our management, who may similarly escalate to the audit committee. These periodic updates include updates on our cybersecurity risk posture, including material risk assessments, the status of any projects to improve our information security systems, and the emerging cybersecurity threat landscape. The audit committee's reviews may also include presentations by members of senior management, as well as briefings with other internal and external subject-matter experts to help broaden the board of directors' understanding of the latest cybersecurity issues and the latest regulatory and threat landscapes. Additionally, the audit committee monitors our progress to address cybersecurity risks and opportunities, as well as cybersecurity incident response and recovery metrics. Our management also periodically engages external service providers to conduct objective assessments of our cybersecurity program, and results of such assessments are directly reported to the audit committee. Finally, the audit committee reports out to the larger board of directors periodically on the company's cybersecurity risks and posture.

companyName: iRhythm Holdings, Inc.

ticker: IRTC


text: Due to the size of the Company and minimal activity level, record keeping requirements are also minimal. All records are tightly maintained on our secure server or in the cloud in our virtual data room. Our engineer and Rick Havenstrite are responsible for oversight as members of management and of the Board of Directors. We do not engage any assessors, consultants, auditors or other third parties in connection with our cybersecurity risk management.

companyName: Desert Hawk Gold Corp.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Additional information about our cybersecurity risks is discussed in "Disruptions to our information systems, including security breaches, losses of data or outages, and other security issues, have and could in the future adversely affect our operations" in Item 1A. Risk Factors, which should be read in conjunction with the information above.

companyName: JABIL INC

ticker: JBL


text: Regular privacy and security training for employees is conducted to enhance awareness and response to cybersecurity threats.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: We manage material risks from cybersecurity threats to our information systems and the information residing in our information systems through various processes and procedures, including, depending on the environment, risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, and employee training. We engage third-party service providers to provide some of the resources used in our information systems and some third-party service providers have access to information residing in our information systems. With respect to such third parties, we seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature and extent of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our processes may include conducting due diligence on the cybersecurity practices of such provider and contractually imposing cybersecurity related obligations on the provider.

companyName: Cryoport, Inc.

ticker: CYRX


text: Role of the Board Our Board oversees the Company's enterprise risk management framework, including information security. The Board has delegated responsibility for overseeing enterprise risk to its Risk Committee, which is governed by a formal charter. Consistent with the Risk Committee Charter, management reports regularly to the Risk Committee on key risks to the Company, including cybersecurity risks. The Chief Information Officer ("CIO") and/or Chief Information Security Officer ("CISO") reports regularly to the Risk Committee on the overall status of and any recommended changes to the information security program, compliance with applicable regulations and material matters related to the program, including the annual risk assessment, risk management and control decisions, service provider arrangements, results of testing and information security-related events, if any, and management's responses to the same. After each Risk Committee meeting, the Risk Committee Chair reports to the Board of Directors on the matters reported on during the committee meeting.

companyName: PRA GROUP INC

ticker: PRAA


text: Collaborative Approach: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: VERACYTE, INC.

ticker: VCYT


text: WEC Energy Group's Board of Directors is responsible for general oversight of the risk environment and associated management policies and practices of WEC Energy Group and its subsidiaries, including us. The WEC Energy Group Board of Directors has delegated to its AOC the responsibility for oversight of our major risk categories and exposures, including with respect to cybersecurity, and management's processes to monitor and control them. The AOC meets regularly throughout the year and receives and reviews various risk management reports about IT/OT cybersecurity, data security, and physical security risk management reports, and discusses these matters with appropriate management and other personnel. WEC Energy Group's CEO (who also serves as our CEO) and its CAO regularly report to the AOC and the WEC Energy Group Board of Directors about cybersecurity matters and risks as well as the adequacy and effectiveness of the cybersecurity risk management program.

companyName: WISCONSIN ELECTRIC POWER CO

ticker: WELPP


text: We employ a specialized third-party information technology ("IT") management firm to monitor and manage our cybersecurity functions. Processes employed include real-time monitoring of company communications and IT activities and also consultation and risk assessment of company procedures. Additionally, our third-party IT firm provides education to management and employees regarding our IT risks. All our employees receive information security training (including data protection and fraud awareness) on an annual basis. Department managers are given additional risk management training as part of periodic management meetings. Our activities are monitored at all times by our IT firm. The IT firm reports all matters of cybersecurity including any threats, breaches, or risks directly to our Chief Financial Officer who reports directly to the Chief Executive Officer. Our Chief Financial Officer regularly meets with the IT firm to review our cybersecurity response plans, discuss any needed updates, and identify risk management actions to be taken. Updates regarding cybersecurity are provided to our directors at least annually and as needed for any important developments including cybersecurity breaches and risks. As of the date of this Annual Report, we know of no cybersecurity incident that has or is likely to materially affect us, our business strategy, our results of operations, or our financial condition.

companyName: RADNOSTIX INC

ticker: INIS


text: The Company identifies and assesses risks from cybersecurity threats by monitoring and evaluating the cybersecurity threat environment and the Company's risk profile. This multi-faceted approach to cybersecurity includes physical, administrative, and technical safeguards. During the year ended December 31, 2023, the Company began utilizing the National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF), to assess and report to the Company's executive management and Board of Directors on the current maturity of operational and procedural controls for securing and safeguarding the Company's information technology assets. The Company will continue to utilize the NIST CSF to evaluate its cybersecurity controls. In addition to the NIST CSF, the Company also completed third-party technical testing of its information technology systems architecture.

companyName: Veris Residential, L.P.


text: No risks from previous cybersecurity threats have materially affected or are reasonably likely to materially affect Stryve's business, financial condition, results of operations and relationships with customers. We describe whether and how risks related to cybersecurity threats are reasonably likely to materially affect us, including our business, financial condition, results of operations and relationships with customers, in Item 1A of this Annual Report on Form 10-K.

companyName: STRYVE FOODS, INC.


text: We design and assess our program generally based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). Although our program may not meet the technical requirements of the NIST CSF, we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Additionally, as we accept credit cards as a form of payment, we consider the requirements of the Payment Card Industry Data Security Standards ("PCI DSS") in relation to our program.

companyName: CHEESECAKE FACTORY INC

ticker: CAKE


text: We believe cybersecurity is critical to advancing our technological developments. As a biopharmaceutical company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business strategy, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Kiromic Biopharma, Inc.


text: Seaboard recognizes the importance of maintaining the trust and confidence of its customers, business partners, employees and other stakeholders with the security of its data and information systems. The Board is involved in the oversight of Seaboard's enterprise risk management program, of which cybersecurity is a component. Seaboard's information security program includes cybersecurity policies, standards, processes and practices that are based on recognized frameworks established by the Center for Internet Security ("CIS") and other applicable industry standards. These frameworks and standards serve as guides and references. Seaboard adapts them to its specific environment, needs and industries. They are not meant to imply that Seaboard meets, or fully complies with, any specific technical standards, specifications or requirements set forth within them. Seaboard seeks to address cybersecurity risks through a comprehensive, company-wide information security program that is focused on preserving the confidentiality, integrity and accessibility of the information that Seaboard collects and stores, supporting legal and regulatory compliance and preventing disruptions to business operations. Seaboard's information security program monitors the systems and networks Seaboard relies upon for threats, breaches, intrusions and potential other weaknesses; assesses the security of company-wide software, applications and systems; responds to cybersecurity incidents; and facilitates training for employees.

companyName: SEABOARD CORP /DE/

ticker: SEB


text: Our processes also aim to address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data, or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our information technology systems, or those of any of our existing or future CROs, manufacturers, other contractors, consultants, or collaborators, may be compromised, which could result in additional costs, significant liabilities, harm to our reputation and material disruption of our operations."

companyName: Pyxis Oncology, Inc.

ticker: PYXS


text: We engage with external cybersecurity consultants to help design and implement our cybersecurity policies and procedures, as well as to monitor and test the effectiveness of our safeguards. The head of information technology (IT), supported by external cybersecurity consultants and the IT Department, implements our cybersecurity risk management system. The head of IT regularly reports on cybersecurity matters to the Chief Financial Officer.

companyName: Oric Pharmaceuticals, Inc.

ticker: ORIC


text: Additionally, we maintain an incident response plan (the "Incident Response Plan"), which establishes a comprehensive, effective, and repeatable process for identifying, escalating and responding to cybersecurity incidents. We test and evaluate the Incident Response Plan, including contingency and recovery plans, on a regular basis, and we develop, implement and review contingency and recovery plans for information systems, both internal and vendor managed. The results of such assessments drive changes and enhancements to governance, policies, procedures, technologies, and partner decisions to continuously monitor and improve our cybersecurity risk management. The Information Security Council practices the procedures of the Incident Response Plan through tabletop exercises facilitated by external consultants. We also leverage third-party support, including vendors, consultants, and assessors, to analyze risk exposure, to identify remediation opportunities and to reduce our overall cybersecurity risk.

companyName: Atmus Filtration Technologies Inc.

ticker: ATMU


text: We have an employee security awareness training program, required upon onboarding and on an annual basis thereafter, that is designed to raise awareness of cybersecurity threats across functions, as well as to encourage consideration of cybersecurity risks across our company. As part of this employee training program, we periodically conduct phishing simulations designed to raise employee awareness of such risks.

companyName: ImageneBio, Inc.

ticker: IMA


text: Our CISO is the member of our management who is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across BlackLine. She has over 15 years of experience as a chief information security officer responsible for enterprise-wide oversight of information security programs. She holds CISSP and CISM certifications, and a BS in Computer Science. She leads a team of information security professionals, and works in coordination with the Chief Information Officer, the Chief Legal and Administrative Officer, the Chief Technology Officer, the Senior Vice President, Cloud Engineering and Operations, and other members of management.

companyName: BLACKLINE, INC.

ticker: BL


text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the Company follows an incident escalation process that is incorporated into our incident and risk management processes. In the event we identify a cybersecurity incident, our senior management, consisting of the Chief Financial Officer, Chief Security Officer (CSO), and Chief Legal Officer, review the facts and circumstances involved in such cybersecurity incident, or series of related cybersecurity incidents.

companyName: NetApp, Inc.

ticker: NTAP


text: Longbridge's cybersecurity processes and practices are integrated into Longbridge's operational risk oversight program. In general, Longbridge also seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that Longbridge collects and stores by identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents when they occur. Longbridge had over 400 employees as of December 31, 2023.

companyName: Ellington Financial Inc.

ticker: EFC


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section entitled "Risk Factors— We are subject to cybersecurity risks to our operational systems, security systems, infrastructure, integrated software in our aircraft, as well as our customer and other confidential data or proprietary information processed by us or third-party vendors."

companyName: Archer Aviation Inc.

ticker: ACHR


text: Our IT department proactively identifies, manages, and mitigates cyber risk in a variety of ways, including but not limited to: A formal enterprise-wide cybersecurity policy and related standards; Cybersecurity training and employee phishing simulations; Ongoing vulnerability assessment, identification, and remediation; Cyber incident response, IT disaster recovery, and business continuity plans; Identity and access management controls; Automated patch management and security updates; Network isolation of key operations environments; and Email filtering with attachment inspection and targeted threat protection.

companyName: Consolidated Water Co. Ltd.

ticker: CWCO