text: Led by our Director of Information Technology and Security ("Director of IT") with over 40 years of experience in Information Technology, our CSIRT, comprising cross-functional professionals, collaborates to execute our cybersecurity risk assessment and management processes by reviewing and assessing cybersecurity initiatives, including the incident response plan, cybersecurity compliance, training, and overall risk management efforts. The collaborative efforts of the Board and our skilled CSIRT team underscore our commitment to effectively addressing and mitigating cybersecurity risks within the organization.

companyName: MEDICAL PROPERTIES TRUST INC

ticker: MPT


text: Our Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. The full Board retains oversight of cybersecurity because of its importance. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks.

companyName: Mobile Global Esports, Inc.

ticker: MGAM

secItem: Item 1C


text: The Cybersecurity Program maintains a cybersecurity governance and oversight framework that seeks to drive accountability for all levels of employees, including senior management and executive officers. Cybersecurity matters are generally managed by a combination of working groups that report to the cybersecurity compliance committee and ultimately the cybersecurity executive oversight committee, as appropriate. Our cross functional cybersecurity compliance committee, which is led by the CISO, is composed of members of senior management, including the CIO, and reviews matters such as cybersecurity escalations, critical remediations and disclosure recommendations. The output from the cybersecurity compliance committee meetings is discussed at meetings of Baxter's cybersecurity executive oversight committee, which is led by the CISO and includes the CIO and other members of management.

companyName: BAXTER INTERNATIONAL INC

ticker: BAX


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level.

companyName: Century Communities, Inc.

ticker: CCS


text: Olo's IRP is also designed to escalate certain cybersecurity incidents to members of management, depending on the circumstances. Our internal security team, among others, works with our CSIRT to help assess, mitigate, and remediate cybersecurity incidents of which they are notified. Our GC, as the CSIRT leader, directs and coordinates CSIRT's activities, in consultation with the CISO and other members of management. In addition, the IRP includes processes for reporting to the audit committee and our Board of Directors certain cybersecurity incidents.

companyName: Olo Inc.


text: Through our incident response plan, we have designated a cybersecurity management committee, or the Cybersecurity Management Committee, composed of our executive officers and management representatives. Led by Our Vice President of Information Technology & Corporate Facilities, our Cybersecurity Management Committee is responsible for the management of the Cybersecurity Program and for the day-to-day investigation of and response to potential information security-related incidents. Pursuant to our incident response plan, incidents meeting specified severity levels are required to be escalated to the Cybersecurity Management Committee for review and response. The goals of the incident response plan are to prevent, detect and react to information security incidents, determine their scope and risk, respond appropriately to the incident, communicate the results and risk to relevant stakeholders, and reduce the likelihood of the incident from reoccurring.

companyName: Sila Realty Trust, Inc.

ticker: SILA


text: The Incident Response Plan includes processes for detecting, containing, and responding to incidents including processes for reporting incidents to management and the Board of Directors. The Company periodically performs simulations and tabletop exercises at a management level and incorporates external advisors as needed. The Company engages third-party services to conduct evaluations of its security controls, whether through penetration testing, independent audits or consulting on best practices to address cybersecurity risks.

companyName: OSHKOSH CORP

ticker: OSK


text: The ISIRP determines how information security incidents are identified, classified, and escalated, including for the purposes of reporting, and providing relevant information to the board of directors. The ISIRP also supports management's assessment of incident materiality.

companyName: Federal Home Loan Bank of Indianapolis


text: We leverage SOC 2 Type 2 attestation framework to determine the operating effectiveness of our internal security controls and use NIST Cybersecurity framework to better understand, manage and reduce cybersecurity risk and protect our business from ever-changing cyber threats.

companyName: Digital Turbine, Inc.

ticker: APPS


text: Such individuals have an average of over 20 years of prior work experience in various roles involving information technology, security, auditing, legal, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.

companyName: VISHAY INTERTECHNOLOGY INC

ticker: VSH


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers, including through due diligence of such providers' cybersecurity practices, contractual obligations to operate their IT systems in accordance with certain cybersecurity standards and ongoing monitoring.

companyName: LENNAR CORP /NEW/

ticker: LEN


text: We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems and ensure the effectiveness of our security controls. Our cybersecurity risk management program is intended to address applicable NIST 800-171 & CMMC requirements for our business. Our cybersecurity risk management program incorporates several components, including information security program assessments, continuous monitoring of critical risks from cybersecurity threats using automated tools, backup testing, periodic threat testing, and documented standards, policies, and procedures. We deploy a wide range of security tools across the environment, and implement access control policies to further limit access to data within the systems.

companyName: Tonix Pharmaceuticals Holding Corp.

ticker: TNXP


text: Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Alset Inc.

ticker: AEI


text: As of the date of this Annual Report, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third-party providers. For additional information, refer to Part I, Item 1A, "Risk Factors—Our business is subject to cybersecurity risks."

companyName: Piedmont Lithium Inc.


text: Impact of Risks from Cybersecurity Threats The energy industry's growing reliance on information technology and operational technology to support critical operations, such as energy production, distribution, and management activities, has made it more susceptible to cybersecurity incidents. As a result, the global rise of cybersecurity incidents, whether from intentional attacks or accidental events, poses a significant challenge to our industry. As cybersecurity threats continue to evolve in complexity and scale, it remains an ongoing and increasingly difficult task for the industry to prevent, detect, mitigate, and remediate these incidents.

companyName: ANTERO RESOURCES Corp

ticker: AR


text: As part of our overall risk management approach, we prioritize the identification and management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised of independent directors from our Board, oversees the responsibilities relating to the operational (including information technology (IT) risks and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through quarterly reports from our cybersecurity leadership and it reports any material findings and recommendations to the full Board for consideration.

companyName: NEWMONT Corp /DE/

ticker: NEM


text: The Board of Directors receives periodic reports from the management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Board of Directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: Processes for Assessing, Identifying, and Managing Cybersecurity Risks The Company has established processes to assess, identify, and manage material risks arising from cybersecurity threats (as defined in Item 106(a) of Regulation S-K). These processes are integrated into the Company's' overall risk management system. Specifically: • The addition of an experienced Chief Information Security Officer ("CISO") with over 25 years of experience to lead the IT Cybersecurity and Compliance team. • Yearly risk assessment designed to help identify material cybersecurity risks to our information systems (as defined in Item 106(a) of Regulation S-K) and data. • A security incident response team that is responsible for managing our cybersecurity risk, security controls, response, and reporting cybersecurity incidents (as defined in Item 106(a) of Regulation S-K). • A cyber and data security incident response plan with policies and procedures for identifying, managing, and recovering from cybersecurity incidents, including escalating tiers of notification and reporting depending on an incident's nature and severity. • The use of third-party service providers, where appropriate, to manage, assess, test, and assist with aspects of our security controls, such as:

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: Conclusion. Our Board of Directors and management take very seriously the information security and cybersecurity obligations Quaint Oak Bancorp and Quaint Oak Bank have to their respective customers, shareholders, staff members, and regulatory agencies. In support of these obligations, we have and actively maintain a robust information security and cybersecurity program based upon industry best practices, regulatory requirements, and the expertise of staff members and supporting third-party vendors.

companyName: QUAINT OAK BANCORP, INC.

ticker: QNTO


text: We have a cross-functional Cybersecurity Board led by our Senior Vice President, Information Technology Systems & Security serving as the chair and consisting of executive-level and non-executive level leaders, including among others, our Chief Financial Officer and General Counsel. This board is responsible for reviewing, engaging and making decisions related to the execution and continuous improvement of cybersecurity strategy, processes and governance impacting our information systems, employees, partners and patients. Our Senior Vice President, Information Technology Systems & Security leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Our Senior Vice President, Information Technology Systems & Security is an experienced senior leader with more than 25 years of experience in information technology within the pharmaceutical industry leading a team of employees and consultants with a breadth of experience including security management experience along with CISSP certification.

companyName: ARVINAS, INC.

ticker: ARVN


text: The Company utilizes information systems to support a variety of business processes and activities in its decentralized operations. These systems may be subject to cyber-based attacks or breaches. For additional information related to the risks associated with cybersecurity threats, refer to the Business and Operational Risks section of Item 1A. Risk Factors.

companyName: ILLINOIS TOOL WORKS INC

ticker: ITW


text: Our senior management team oversees our cybersecurity strategy and has the overall responsibility for assessing and managing our exposure to cybersecurity risk, with the audit committee of the board of directors providing board level oversight of the activities conducted by management to monitor and mitigate cybersecurity risks. Our corporate information security organization, led by our Chief Information Security Officer ("CISO"), develops and directs our information security strategy and policy, security engineering, operations and cyber threat detection and response. Our CISO has 22 years of experience in cybersecurity and 16 years in cybersecurity management, received a bachelor of science in management information systems and a masters of business administration from Rochester Institute of Technology, and is a Certified Information Systems Security Professional. Cybersecurity strategy and updates are reviewed by our executive leadership team on a monthly basis and are presented to other internal committees. The audit committee receives a regularly scheduled report on cybersecurity matters and related risk exposure from our CISO, chief technology officer or other similar officers. When covered during an audit committee meeting, the chair of the audit committee reports on its discussion to the full board.

companyName: Optimum Communications, Inc.

ticker: OPTU


text: Identification of sources and types of technology threats Tools and processes to manage technology security, such as change control approval, employing a Unified Threat Management System, and usage of anti-virus and anti-spam hardware Ongoing security assessments conducted by third-party vendors, such as vulnerability assessments and penetration testing, and mitigation of any findings Continuous firewall monitoring provided by a third-party vendor Information security training for employees provided by a third-party vendor Annual security audits of third-party vendors Our Information Security Governance Plan ("InfoSec") is a component of the ISP and provides for strategic oversight of critical aspects of the Bank's information security. The objective of InfoSec is to provide a framework for decision-making and accountability for information security issues to ensure that the ISP is actively monitored and information security permeates through all areas and initiatives across the organization.

companyName: MIDDLEFIELD BANC CORP

ticker: MBCN


text: As part of our overall risk management system, we monitor and test our safeguards, including through annual third-party vulnerability assessments. We train our employees on these safeguards, in collaboration with human resources, IT, and departmental management. Personnel at all levels and departments are made aware of our cybersecurity policies through training.

companyName: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.

ticker: PACB


text: 8x8 conducts regular risk assessments to identify and prioritize cybersecurity risks. Through measures such as vulnerability assessments, and penetration testing, the Company identifies potential vulnerabilities and takes proactive steps to address them. 8x8 has also implemented technical, administrative and legal controls to manage our risk from third party service providers, including implementation of a third-party vendor risk management platform. Individuals or entities have attempted, and will continue to attempt, to penetrate our network security, and that of our platform, to try to cause harm to our business operations, including by misappropriating our proprietary information or that of our customers, employees and business partners or causing interruptions of our products and platform. See the sections entitled "Risks Related to our Products and Operations" and "Risks Related to Regulatory Matters" in Part I, Item 1A "Risk Factors" for more information on our cybersecurity risks.

companyName: 8X8 INC /DE/

ticker: EGHT


text: Cybersecurity risk management is one component of our information security program that guides continuous improvement to, and evaluates the confidentiality, integrity, and availability of our critical systems, data, and operations.

companyName: American Bitcoin Corp.

ticker: ABTC


text: We periodically engage qualified third parties to perform external assessments and audits of our overall security program, as well as to perform detailed security assessments of various components of our overall technology infrastructure. We also supplement our own internal expertise with qualified third parties to engage in varying security operational functions aiding in the identification and remediation of potential cybersecurity threats.

companyName: FIVE BELOW, INC

ticker: FIVE


text: Cybersecurity is one of the cornerstones of our strategic business plan and the driving force behind our digital transformation journey. As a financial institution, we confront a spectrum of cyber threats, ranging from common attacks like ransomware to sophisticated, organized assaults by nation-state actors. These risks extend to our customers, shareholders, suppliers, and partners, emphasizing the critical need for a robust cybersecurity stance. In light of these challenges, maintaining resilience in our cybersecurity posture is not just a priority but a fundamental necessity to safeguard our operations, performance, and the maintenance of customer confidence in our banking services.

companyName: BayCom Corp

ticker: BCML


text: We also maintain business continuity plans that include identification of critical functions, third-party suppliers, and personnel. Our information technology department executes several disaster recovery exercises per year in order to test our capabilities and ensure that business recovery needs could be met during a real-world event. Additionally, our information technology department participates in annual crisis management exercises to test our operational responses and assess our preparedness for various scenarios, including cyber incidents. We also participate annually in industry-wide and internal exercises to test our response capabilities.

companyName: RAYMOND JAMES FINANCIAL INC

ticker: RJF


text: In addition, we operate a third-party cyber risk management capability which monitors the exposure of significant IT suppliers, significant software as a service suppliers and major vendors with access to our IT systems. We also monitor for significant changes in our cybersecurity risk posture and attempt to remediate the risk through collaboration with that partner. We also monitor for known breaches of the IT supplier landscape.

companyName: MOLSON COORS BEVERAGE CO

ticker: TAP


text: As of the date of this report, we have not identified cybersecurity threats that have materially affected or are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. We may face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. See "Risk factors related to our information technology and cybersecurity systems" included as part of Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: COTY INC.

ticker: COTY


text: Role of Management Pathward's Information Security Program is managed by the Company's Chief Product and Technology Officer ("CPTO") and Chief Information Security Officer ("CISO"). The current CPTO has over 30 years of experience in senior leadership positions in the areas of information technology, technology innovation and enterprise architecture, and has been recognized for various technology and leadership awards. The current CISO reports to the CPTO and has extensive years of experience in information security both at Pathward and at other companies as well as many years of executive management experience. The CISO regularly reports to executive management, the Risk Committee of the Board of Directors (the "Board Risk Committee") and the Board of Directors regarding all aspects of information security including cybersecurity risk and incidents. The Information Technology Committee and Executive Risk Committee provide governance and oversight of the Information Security Program. These Committees convene at least four times annually, reporting significant activities and issues upward to the Board Risk Committee and the Board of Directors as necessary.

companyName: PATHWARD FINANCIAL, INC.

ticker: CASH


text: We have implemented a risk management process and formed a Risk Management Committee, which consists of members of our management team, including members with technical expertise, to identify, evaluate and categorize any potential InfoSec risks. We perform vulnerability testing and penetration testing at routine intervals to assure that our InfoSec posture remains vigilant. We utilize and maintain third-party security vendors, as necessary, to provide assistance with a variety of security efforts.

companyName: Rumble Inc.

ticker: RUM


text: In addition, each year, we undergo System and Organization Controls ("SOC") 1 and SOC 2 audit reviews performed by an independent third-party firm to test our information technology systems internal controls. In 2023, we also engaged a third-party service provider to conduct a cybersecurity maturity assessment of our information security program. We also regularly engage additional assessors, auditors and service providers in connection with the implementation, assessment, enhancement and evaluation of our cybersecurity program, including our risk management processes.

companyName: Tradeweb Markets Inc.

ticker: TW


text: Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the SOC reports of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: Sunshine Biopharma Inc.

ticker: SBFM


text: The Company's Chief Technology Officer has been serving in this role for the Company since March 2025 and has over 30 years of experience in various information security and related technology roles. The Chief Technology Officer oversees the information technology and information security functions of the Company which includes our cyber risk management team.

companyName: BrightView Holdings, Inc.

ticker: BV


text: The Audit Committee of the Board of Directors performs an annual review of our cybersecurity program, including management's actions to identify and detect threats. The Board receives periodic reports and annual updates on our crisis management plan which includes cybersecurity. Both the Chief Science Officer and the Chief Financial Officer share responsibility for our program and solicit support of third party experts as necessary.

companyName: USBC, Inc.

ticker: USBC


text: While we have implemented extensive measures to fortify our defenses against cyber threats, it is important to acknowledge that the cybersecurity landscape is constantly evolving, with threat actors employing increasingly sophisticated tactics. Despite our best efforts, we cannot guarantee that our systems will be completely immune to cyber attacks. As such, we maintain a proactive stance in monitoring for emerging threats and vulnerabilities, leveraging threat intelligence sources and collaborating with industry partners to stay abreast of evolving risks.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: Given the importance of cybersecurity to our business, we maintain a robust cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of safeguards, such as: complex password protection; multi-factor authentication with geo-location and multi-step confirmation; continuous monitoring and alerting systems for internal and external threats; regular evaluations of our cybersecurity program, including periodic internal and external audits, penetration tests, and incident response planning; and industry benchmarking. We also require cybersecurity training when onboarding new employees and contractors assigned access to Optinose networks, as well as bi-annual, required cybersecurity awareness training for our employees and contractors assigned access to Optinose networks. Our program leverages industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) to strengthen our program effectiveness and reduce cybersecurity risks.

companyName: OptiNose, Inc.


text: Containment, Eradication and Recovery: The Company's Cybersecurity Plan includes processes for containing ongoing cybersecurity threats if they occur and preventing past malicious activity, providing proposed solutions to malicious activity, and recovering any business processes with the goal of restoring business operations.

companyName: Verano Holdings Corp.

ticker: VRNO


text: The Company's incident response team is comprised of leaders from our information security team, risk, legal and audit departments. We have established and regularly test incident response processes and controls that identify and risk-rank incidents through a centralized system to promote timely escalation of cybersecurity incidents that exceed a particular level of risk. Incidents of sufficient magnitude or severity are escalated to the appropriate Company officers.

companyName: BRINKER INTERNATIONAL, INC

ticker: EAT


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats include the following: • Ongoing Assessment—The Cybersecurity Risk and Compliance department, led by the Managing Director, Chief Information Security Officer (CISO), and reporting to the SVP, Chief Information and Digital Officer (CIDO) is staffed with cyber professionals tasked with the day-to-day responsibility of assessing material risks from cybersecurity threats. In addition, the Cyber Security Council, comprised of senior management, is kept apprised of the state of PSEG's cybersecurity program, including any emerging risks, and provides guidance on the strategic directions of the program. • Engagement of Third Parties—We engage third parties, such as security service providers, risk management firms and external legal counsels to assess material risks from cybersecurity threats and report on our internal incident response preparedness and cyber posture, support incident response, conduct tabletop exercises, and comply with applicable laws and regulations. We also carry cybersecurity insurance that provides certain protection against losses from a cybersecurity incident. Regulatory agencies, including but not limited to the NRC and Transportation Security Administration, as well as NERC, inspect applicable components of our cybersecurity program. • Third-Party Service Provider Management—We maintain processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. This includes a risk-based vendor management program, which incorporates robust security contractual provisions, vendor security assessments and, if appropriate, periodic audits. • Technical Safeguards—We manage controls to protect our network perimeter, internal IT and Operational Technology (OT) environments, such as internal and external firewalls, network intrusion detection and prevention, penetration testing, vulnerability assessments, threat intelligence, anti-malware and access controls. • Training and Awareness—We provide mandatory annual cybersecurity training for all personnel with network access, as well as additional education for personnel with access to industrial control systems or customer information systems; and conduct phishing exercises with progressive consequences for failures. Employees also receive periodic cybersecurity awareness messages and each October, in recognition of Cybersecurity Awareness Month, are invited to presentations throughout the month from internal and external cyber experts covering diverse cyber topics. These efforts better enable all employees to identify potential cybersecurity risks and escalate them appropriately. • Incident Response Plans—We maintain and periodically update a cyber incident response plan that addresses the life cycle of a cybersecurity incident from a technical perspective (i.e., detection, response, and recovery), as well as a data breach response plan (with a focus on external communication/disclosure and legal compliance); and conduct regular tabletop exercises to test plan effectiveness (both internally and through external exercises). • Mobile Security—We maintain controls to prevent loss of data through mobile device channels.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: Although the Company has combatted cybersecurity threats in the normal course of business, these threats have not materially affected its operations, business strategy, results of operations, or financial condition. While the Company strives to implement highly effective cybersecurity measures, it recognizes that the threat landscape is continually evolving. Future attacks, if not successfully prevented or mitigated, could materially affect the Company, including its operations, business strategy, results of operations, or financial condition. See Item 1A, Risk Factors, of this Annual Report on Form 10-K for additional information.

companyName: BUCKLE INC

ticker: BKE


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including " If our information technology systems, or those of third parties with whom we work, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to: regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences. "

companyName: AETHLON MEDICAL INC

ticker: AEMD


text: While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, we cannot assure you that we will not experience such an incident in the future. Any cybersecurity incidents, whether or not successful, could result in our incurring additional costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, responding to regulatory inquiries or actions, paying damages or making payments to obtain access to our computer systems, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. We have seen an increase in cyberattack volume, frequency, and sophistication. We seek to detect and investigate unauthorized attempts and attacks against our network, products, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our products and services; however, we remain potentially vulnerable to known or unknown threats. In some instances, we, our suppliers, our customers, and the users of our products and services can be unaware of a threat or incident or its magnitude and effects. Further, there are increasing regulation requirements regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm.

companyName: Wetouch Technology Inc.

ticker: WETH


text: oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports from Carlyle on our enterprise risk profile on an annual basis. In addition, Carlyle's Chief Information Security Officer ("CISO") leads our cybersecurity program, chairs Carlyle's Information Security Steering Committee ("ISSC"), and provides cybersecurity status reporting to our Audit Committee at least annually. The ISSC meets quarterly and ensures that cybersecurity initiatives are in alignment with Carlyle's strategic priorities.

companyName: Carlyle Secured Lending III


text: Our cybersecurity program is integrated into our overall risk management systems, including our annual enterprise risk management program, business continuity and crisis management programs, third-party risk management program, insurance risk management program, and employee compliance programs. We have implemented and maintain comprehensive processes designed to manage and mitigate material cybersecurity threats to ensure that the company operates in a protected, compliant environment.

companyName: MANNATECH INC

ticker: MTEX


text: Assessing, identifying, and managing cybersecurity related risks are integrated into our overall risk management program. Our CEO, General Counsel, and Vice President of Quality and Technical Operations ("VP of Quality") directly oversee the development, implementation, operation, and revision of our cybersecurity policies and procedures, and are primarily responsible for the oversight of risks from cybersecurity threats and any security incidents that may occur. These officers have more than 24 years of combined experience in managing IT, operations, and information risk and security. Our VP of Quality has experience developing comprehensive information security programs for organizations, and brings extensive experience in the private sector and is a specialist in IT governance strategies, risk management protocols, and compliance frameworks. All security incidents are managed by our VP of Quality and reported to management, including our CEO, General Counsel, and other personnel based upon the specifics of the incident and its impact. Additionally, if a known or suspected security incident occurs at the Company, based upon its risk classification and if we assess the impact to be critical, the incident is escalated in a timely manner to the Audit Committee of the Board of Directors for oversight of the monitoring, reporting, and response process. The Audit Committee also oversees the implementation of our policies and procedures to prevent or reduce cybersecurity risks on an ongoing basis during the performance of its general committee duties.

companyName: Clene Inc.

ticker: CLNN


text: Identification of Threats Associated with Third Parties Baker Hughes utilizes a third-party risk management ("TPRM") program to identify, assess, monitor, and mitigate risks associated with suppliers and vendors, including cybersecurity risks. We conduct initial risk assessments of third-party suppliers and service providers based on various factors to classify each into a risk category. Our TPRM program is designed to apply our most rigorous processes to those suppliers and service providers that are classified into the highest risk category. These processes include due diligence assessments of third-party suppliers and service providers that have access to Baker Hughes networks, confidential information, and information systems in order to assess the risks from cybersecurity threats that could impact our suppliers and third-party service providers. We leverage external partners to assist with the regular assessment of our top priority suppliers and third-party service providers to identify, review and address risks, including deeper reviews of their cybersecurity controls. We track the identified deficiencies and include with other cybersecurity metrics based on their severity. We also require that our suppliers and third-party service providers have in place appropriate technical and organizational security measures and security-control principles based on recognized cybersecurity standards.

companyName: Baker Hughes Co

ticker: BKR


text: We have been, and in the future may be, the target of cyberattacks, including the previously disclosed November 2022 cyberattack on the Company and related data breach. We do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. We continue to enhance our data security infrastructure and take further steps to prevent unauthorized access to our systems and the data we maintain. For additional information regarding the risks from cybersecurity threats we face, see " Risks Related to Our Business – We could incur significant liability, and our business, financial condition, results of operations and reputation could be harmed, if our information systems are breached or we otherwise fail to protect customer, investor, employee or Company data or systems" under Part I, Item 1A. "Risk Factors" above.

companyName: 1st FRANKLIN FINANCIAL CORP


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Financial Officer. Our Chief Financial Officer receives regular reports on the status of our cybersecurity measures, and works with the Company's incident response team in an effort to help the Company mitigate and remediate cybersecurity incidents of which they are notified, and to assess and determine materiality for reporting purposes.

companyName: Bolt Biotherapeutics, Inc.

ticker: BOLT


text: The Container Store has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We design and assess our program based on a hybrid security framework model using the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and the Payment Card Industry Security Standard (PCI DSS). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF and PCI DSS as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Container Store Group, Inc.


text: Cybersecurity Risk Management and Oversight Our cybersecurity risk management program is built to protect our systems, data, and customers from a wide range of cyber threats. This includes internal protocols and controls, as well as third-party oversight. Our cybersecurity practices are guided by the National Institute of Standards and Technology (NIST) CSF (Cyber Security Framework), and categorizes cybersecurity tasks into five key functions: identify, protect, detect, respond, and recover. This functional orientation helps organizations make informed decisions about reducing cyberattacks.

companyName: PETMED EXPRESS INC

ticker: PETS


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. We regularly assess the cybersecurity landscape to holistically evaluate the threat of cybersecurity risks and seek to mitigate such risks through a layered cybersecurity strategy based on identification, protection, detection and recovery. Our Enterprise Cybersecurity Policy includes guidance related to encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information and the use of the internet, social media, email and wireless devices. This policy is reviewed for updates annually and approved by appropriate members of management. All coworkers are required to acknowledge review of the policy and complete cybersecurity and privacy awareness training annually. We also provide coworkers with additional cybersecurity training through online offerings, company broadcasts and security awareness events. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. The cybersecurity program is being enhanced to ensure that critical vendors and other third-parties are risk assessed prior to being given access to the Company's information assets and networks. Additionally, processes are currently in place to review existing third-party access to systems that have a material impact on the financial statements of the Company.

companyName: UPBOUND GROUP, INC.

ticker: UPBD


text: Our internal systems, processes, and controls are designed to mitigate loss from cyberattacks and, if necessary, remediate any potential damage. While we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected the Company's business, financial condition, and results of operations. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cybersecurity breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A Risk Factors.

companyName: National Bank Holdings Corp

ticker: NBHC


text: S&T performs periodic risk assessments that seek to identify both technical and physical risks to information systems. The assessments incorporate cybersecurity-related principles from the Federal Financial Institutions Examination Council, or FFIEC, Information Technology Examination Handbook, regulatory guidance and concepts from other industry standards, including the NIST Cybersecurity Framework. An assessment typically includes: a. Identifying reasonably foreseeable internal and external threats that could result in a cybersecurity incident;

companyName: S&T BANCORP INC

ticker: STBA


text: Our cybersecurity program includes a dedicated cybersecurity function led by our Chief Information Security Officer ("CISO"). As part of our cybersecurity function, our Distributed Security Incident Response Team ("DSRT") administers a program to monitor, detect, investigate, respond to, and escalate management of internal and external cybersecurity threats and incidents. The DSRT provides threat intelligence information from internal and external resources to our CISO, broader security and resiliency organization, and relevant business units and functional areas as one source within our risk assessment process. Our cybersecurity function partners closely with our Data Privacy organization, led by the Business Integrity Officer, and others within the Legal organization to ensure prompt response on data breach and any other regulatory notification requirements. We have incident response and recovery plans that we test and evaluate for effectiveness in accordance with industry standards.

companyName: Elastic N.V.

ticker: ESTC


text: During 2023, the Board of Directors established a special subcommittee with the goal of reviewing the Company's overall cybersecurity risk and response landscape. The special Cybersecurity subcommittee is comprised of board members with diverse expertise including risk management, technology and finance, with two members holding Cybersecurity Oversight Certificates issued by the National Association of Corporate Directors and Carnegie Mellon University.

companyName: CLEAN HARBORS INC

ticker: CLH


text: As a smaller reporting company, we currently do not have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity risks.

companyName: 60 DEGREES PHARMACEUTICALS, INC.

ticker: SXTP


text: Cybersecurity Governance Structures Management's Role in Managing Cybersecurity Risk We are committed to protecting sensitive information and have a dedicated cybersecurity group within our IT department that is overseen by our Chief Information Officer. This group provides a quarterly cybersecurity report to our senior management, including the Chief Executive Officer, President, Chief Financial Officer, Chief Operating Officer, Chief Administrative Officer, Chief Information Officer, General Counsel, business segment Presidents and the Vice President—Corporate Security. This senior management team is involved in all significant cybersecurity decisions, including efforts undertaken to comply with the security directives issued by the TSA. Our Chief Executive Officer, General Counsel and our Chief Information Officer have attended classified briefings on cybersecurity in Washington, D.C. In addition to the quarterly reports to senior management, the cybersecurity team prepares broader management briefings that include updates regarding company-wide cybersecurity matters and initiatives and provide a forum for discussing data security risk solutions and formulating action plans.

companyName: KINDER MORGAN, INC.

ticker: KMI


text: As part of our board refreshment efforts in recent years, we have added directors with information technology governance skills. Currently, five members of our Board have cybersecurity experience from their principal occupation, other professional experience or third-party director education courses on cybersecurity, including cyber risk governance, and data privacy and security issues and trends.

companyName: Extra Space Storage Inc.

ticker: EXR


text: In the ordinary course of our business, we collect, use, store, and transmit digitally confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To that end, we rely on a multidisciplinary team (including from our IT function, senior management, and third-party service providers, as described further below) to assess how identified cybersecurity threats could impact our business. These assessments may leverage, among other processes, industry tools and metrics designed to assist in the assessment of risks from such cybersecurity threats.

companyName: Dianthus Therapeutics, Inc. /DE/

ticker: DNTH


text: Our Board is responsible for the oversight of cybersecurity risk management. The Board delegates oversight of the cybersecurity risk management program to the Audit Committee. On a quarterly and as-needed basis, the CFO reports to the Audit Committee on our cybersecurity risk management program, including any critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards.

companyName: Avalon GloboCare Corp.

ticker: ALBT


text: Given the potential significance of cybersecurity threats to our operational integrity and stakeholder confidence, our Board of Directors has established oversight mechanisms to promote effective governance in managing such risks.

companyName: HashiCorp, Inc.


text: Management is responsible for the implementation of risk management strategies and for the operational oversight of company-wide cybersecurity strategy, policy, and standards to assess and prepare us to address cybersecurity risks. We have evolving processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from cyber threats, protect employee and corporate information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, and routine review of our policies and procedures to identify risks and refine our practices. We engage independent third parties to assess and implement our cybersecurity procedures and enhance our oversight.

companyName: Progressive Care Inc.


text: Our cybersecurity program includes a variety of processes to assess, identify and manage risks from cybersecurity threats arising from our own and third-party provided systems, including information security policies and procedures, simulation exercises, network and endpoint monitoring and detection tools, vulnerability management processes, risk assessments, third-party penetration testing and security requirements for our suppliers, vendors, and service providers. We have also engaged third parties to enhance and strengthen our cybersecurity program, to provide additional capabilities and support, and to provide periodic independent assessments and evaluations of our cybersecurity program, including through table top exercises to simulate responses to cybersecurity incidents, and other professional services.

companyName: Varex Imaging Corp

ticker: VREX


text: If deemed appropriate, we design and implement reasonable safeguards to address any identified gaps in our existing processes and procedures, including annual cybersecurity awareness training emphasizing the use of strong passwords on all systems and aligning cyber-risk management policies with the Company's needs by integrating cyber-risk analysis into significant business decisions and ensuring that the Company's organization structure supports such cybersecurity goals.

companyName: Kun Peng International Ltd.

ticker: KPEA


text: Prosper recognizes the critical importance of protecting the company's assets and customer data against new and existing risks using appropriate organizational measures, policies, procedures, and technical solutions while maintaining robust cybersecurity measures to safeguard our information systems and protect the security, confidentiality, integrity, and availability of our data.

companyName: PROSPER MARKETPLACE, INC


text: Impacts from Cybersecurity Threats Although we have experienced cybersecurity incidents, we do not believe they have, or are likely to have, a material impact on the business. However, we recognize that cybersecurity threats are constantly evolving, and future incidents remain a possibility. Despite our security measures and IT controls, we cannot guarantee that future cybersecurity incidents will be prevented. A successful attack could have significant consequences for the business. For more information on the risks associated with cybersecurity threats, see Item 1A, Risk Factors - "Risk Related to Information Technology and Cybersecurity."

companyName: STAR GROUP, L.P.

ticker: SGU


text: Cybersecurity Risk Assessment, Identification and Management We are committed to protecting our information technology ("IT") infrastructure, including computers, systems, corporate networks and sensitive data, from unauthorized access or attack. We have established global IT policies as well as IT security management control procedures designed to assess, identify, and manage material risks from cybersecurity threats by: Creating information security awareness among our employees and business partners and defining responsibilities among them; Implementing controls to identify IT risks and monitor the use of our systems and information resources; Establishing key policies and processes to adequately and timely respond to security threats;

companyName: POWER INTEGRATIONS INC

ticker: POWI


text: Risk Management and Strategy Qurate Retail's corporate level IT and cybersecurity functions are provided by LMC as part of the services agreement described in Item 1. Business. Through the services agreement, we participate in LMC's processes for assessing, identifying, and managing risks from cybersecurity threats at the corporate level, as detailed below. QVC operates its own cybersecurity function with oversight from Qurate Retail.

companyName: QVC Group, Inc.

ticker: QVCGA


text: Role of the Board of Directors and the Audit Committee As part of the Board of Directors' role in overseeing the Company's enterprise risk management program, which includes our cybersecurity risk management framework, the Board is responsible for exercising oversight of management's identification and management of, and planning for, material cybersecurity risks that may reasonably be expected to impact the Company. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee. The Audit Committee is responsible for overseeing the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework, taking into account the Company's risk exposures and progress of its risk management processes. The Audit Committee is informed of the Company's cybersecurity risk management and receives an overview of its cybersecurity program from management at least quarterly, which covers topics including, among others, recent cybersecurity risk landscape and trends, data security posture, results from third-party assessments, training and vulnerability testing, our incident response plan, material cybersecurity risks, whether developing or actual, as well as the steps management has taken to respond to such risks, emerging cybersecurity regulations, technologies and best practices. Material cybersecurity risks are also discussed during separate Board meetings as part of the Board's risk oversight generally.

companyName: R F INDUSTRIES LTD

ticker: RFIL


text: The Corporation leverages regular assessments to identify current and potential threats and vulnerabilities within the Corporation's environment. Technical vulnerabilities are identified using automated vulnerability scanning tools, penetration testing, and system management tools, whereas non-technical vulnerabilities are identified via process or procedural reviews. The Corporation conducts a variety of assessments throughout the year, both internally and through third parties. Vulnerability assessment and penetration tests are performed on a regular basis to provide the Corporation with an unbiased view of its environment and controls. Vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to management on a regular basis. A multi-step approach is applied to identify, report and remediate these vulnerabilities, and the Corporation adjusts its information security policies, standards, processes and practices as necessary based on the information provided by these assessments. The results of key assessments are reported in summary to the Board of Directors annually.

companyName: ASSOCIATED BANC-CORP

ticker: ASB


text: Our CISO works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our incident response and recovery plans. Through the ongoing communications from these teams, the CISO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and reports such incidents to the Board when appropriate.

companyName: BOYD GAMING CORP

ticker: BYD


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third -party risk management process for key service providers, based on our assessment of their criticality to our operations and respective risk profile. For more information, see " If our security measures are compromised now, or in the future, or the security, confidentiality, integrity or availability of, our information technology systems, software, services, communications or data is compromised, limited or fails, this could result in a material adverse impact, including without limitation, a material interruption to our operations, harm to our reputation, significant fines, penalties and liability, breach or a triggering of data protection laws, privacy policies and data protection obligations, loss of customers or sales, or material disruption of our clinical trials or other business activity. " in the " Risk Factors " section above.

companyName: ZEVRA THERAPEUTICS, INC.

ticker: ZVRA


text: Our Board considers cybersecurity risk and other information technology risks as part of its risk oversight function. The full Board oversees management's implementation of our cybersecurity risk management program.

companyName: e.l.f. Beauty, Inc.

ticker: ELF


text: Additionally, Dow engages in cyber crisis response simulations to assess Dow's ability to adapt to information and operational technology threats. Improper or illegitimate use of the Company's information system resources or violation of the Company's information security policies and procedures is subject to disciplinary action. Dow's security posture is supported by a comprehensive defense-in-depth strategy that relies on layers of technology including Multi-Factor Authentication and principles of Zero Trust to ensure that access to information and communication is vetted and secure.

companyName: DOW INC.

ticker: DOW


text: we deploy systems safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence;

companyName: Sky Harbour Group Corp

ticker: SKYH


text: Blackstone's CSO and CTO have extensive experience in cybersecurity and technology, respectively. Blackstone's CSO, Adam Fletcher, is a Senior Managing Director in BXTI and is responsible for all aspects of cyber and physical security across Blackstone. Prior to his appointment as CSO in 2017, Mr. Fletcher was Blackstone's Deputy CSO. Before joining Blackstone in 2014, Mr. Fletcher led the International Security organization for Equifax from 2012 to 2014. Blackstone's CTO, John Stecher is a Senior Managing Director and head of BXTI. Mr. Stecher is responsible for all aspects of technology across Blackstone. Mr. Stecher also advises Blackstone's investment teams and acts as a resource to Blackstone portfolio companies, and externally managed companies, such as us, on technology-related matters. Before joining Blackstone in 2020, Mr. Stecher was a Managing Director and the Chief Technology Officer and Chief Innovation Officer at Barclays. He was also a member of the Barclays Technology Management Committee. Prior to joining Barclays in 2017, Mr. Stecher held a variety of senior management and engineering roles across Goldman Sachs' capital markets and technology divisions.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: As a global company, we have experienced cybersecurity attacks and incidents in the past, and we could in the future experience similar attacks. To date, we have not experienced a cybersecurity incident or attack, or any risk from cybersecurity threats, that has materially affected or is reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition.

companyName: PHINIA INC.

ticker: PHIN


text: To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management program, which is comprised of a wide array of architecture and processes. The cyber risk management program falls under the responsibility of our Chief Financial Officer who, in turn, manages our outsourced experts in IT and cyber security. Under the guidance of our Chief Financial Officer, we task reputable third-party IT experts that utilize a wide variety of software to secure the environment.

companyName: Cingulate Inc.

ticker: CING


text: We are subject to various cybersecurity risks in connection with our business. See the section entitled "Cybersecurity Risks" in Part I, Item 1A. Risk Factors of this Annual Report on Form 10-K. Our cybersecurity program is led by an experienced team of cybersecurity professionals headed by our Chief Information Security Officer (CISO), reporting to our General Counsel.

companyName: ANSYS INC


text: We operate in an industry that requires the continuous use and operation of information and telecommunications systems. In addition, we use information technology systems to collect and retain sensitive information, including confidential and proprietary information about our businesses, and personal information about our customers, shareowners and employees.

companyName: WISCONSIN POWER & LIGHT CO


text: As part of the above approach and processes, we have engaged an assessors to review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.

companyName: BioAtla, Inc.

ticker: BCAB


text: We manage, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: through the use of automated tools, including but not limited to tools for monitoring, remote wiping, threat detection, intrusion detection and prevention; conducting (through third parties) regular audits and threat assessments for internal and external threats; subscribing to reports and services that identify cybersecurity threats; analyzing reports of threats and actors; conducting vulnerability assessments to identify vulnerabilities; evaluating our and our industry's risk profile; and evaluating threats reported to us.

companyName: Climb Bio, Inc.

ticker: CLYM


text: Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: 10x Genomics, Inc.

ticker: TXG


text: The Company has implemented policies and procedures related to disclosing its cybersecurity risks and management strategies in its annual report, SEC filings, or other regulatory filings providing investors with an understanding of the potential impact on the Company's operations and financials.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: Cybersecurity Risk Management and Strategy ORIX USA has a Chief Information Officer (the "ORIX USA CIO"), who leads an information and cybersecurity team (the "ORIX USA information and cybersecurity team") responsible for managing information security at ORIX USA's asset management business, including its Cybersecurity strategy and program, which encompasses annual employee training about Cybersecurity risks and new employee onboarding about ORIX USA's security policies. The ORIX USA information and cybersecurity team's responsibilities cover three main areas: (i) operations and engineering, (ii) threat detection and response, and (iii) governance. The team comprises members with diverse and relevant skill sets and expertise. The ORIX USA CIO leads the cybersecurity team with over twenty years of experience at ORIX USA and prior experience as a principal with a large management consulting firm. This team has developed a program aligned with the NIST CSF framework, emphasizing training and development, with team members holding industry-recognized certifications complemented by industry-recognized third-party providers for threat and incident management.

companyName: BCTC IV ASSIGNOR CORP


text: Responsibilities of the Board of Directors Our Board provides oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure and the mitigation and remediation of cybersecurity incidents, and our executive officers (including our CEO, CFO, and COO) are responsible for the day-to-day management of the material risks we face, including cybersecurity risks. Our Board administers its cybersecurity risk oversight function as a whole, as well as through the Audit and Risk Committee ("ARC"). Our corporate security team informs the Board and ARC of certain cybersecurity risks and threats during quarterly meetings and provide materials shared in connection with such meetings, as well as ad hoc updates when there are material developments or changes that may impact cybersecurity risk to the company. Refer to "Item 10. Directors, Executive Officers and Corporate Governance" section of this Annual Report for additional information regarding the ARC and other committees of the Board as well as the ARC charter.

companyName: Life360, Inc.

ticker: LIF


text: Retaining of third parties to periodically assess our cybersecurity management program, provide cybersecurity training, perform phishing tests, gap analysis and penetration tests, advise on business continuity plans, and to provide additional support in the event of a cybersecurity incident.

companyName: Altimmune, Inc.

ticker: ALT


text: Our Senior Director and Head of Information Technology and representatives from our management committee on cybersecurity provide annual briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.

companyName: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.

ticker: PACB


text: IT management provides updates to the company's senior management throughout the year, covering, as appropriate, the company's cybersecurity strategy, initiatives, key security metrics, penetration testing and benchmarking learnings, and business response plans, as well as the evolving cybersecurity threat landscape.

companyName: IMPERIAL OIL LTD

ticker: IMO


text: We use the Three Lines Model in order to ensure our information security program's effectiveness and readiness. Our first line is our IT Security Operations, which implements and executes upon a robust control framework, while our Information Security Assurance function maintains an information security assurance program that includes external penetration management and performing third-party risk assessments. Our second line is our Risk and Compliance functions. Our Risk function performs table top exercises, "red team" testing and stress testing, while our Compliance function ensures regulatory requirements are identified proactively and monitors compliance with our internal policies and procedures. Our third line consists of our Internal Audit function, which provides objective assurance and testing over internal policies and procedures related to our information security program.

companyName: Enstar Group LTD


text: The Risk Management Steering Committee includes our Chief Financial Officer ("CFO"), General Counsel ("GC"), Senior Vice President, Operations and Technical Support ("SVP-Ops"), Senior Vice President, Engineering ("SVP-Engineering") and Group Vice President, Information Technology ("GVP-IT") and other business unit representatives and subject matter experts, who regularly interact with our ERM function. The Risk Management Steering Committee works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the company are deployed to address cybersecurity threats and to respond to cybersecurity incidents.

companyName: Vizio Holding Corp.


text: We have engaged external parties, including risk management consultants and computer security firms, to enhance our cybersecurity oversight. In an effort to deter and detect cyber threats, we periodically provide training programs to our employees on issues related to privacy and data protection, cybersecurity risks, and the importance of reporting all incidents immediately. Topics include identifying phishing, password protection, securing confidential data, and mobile security. In addition, we use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We also perform annual vulnerability assessments, conducted by independent, third-party cybersecurity firms.

companyName: Rezolute, Inc.

ticker: RZLT


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. Such occurrences could negatively impact our business strategy, reputation and results of operation. For more information about the cybersecurity risks we face, see our risk factors in Item 1A- Risk Factors in this Annual Report on Form 10-K.

companyName: Nuwellis, Inc.

ticker: NUWE


text: The Board of Directors, through the ITSC and CRMC, provides direction and oversight of the enterprise-wide risk management framework of the Company, including the management of risks arising from cybersecurity threats. The Board of Directors review and approve the Information Security Policy. The Board of Directors receives regular presentations which include updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board of Directors also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the full Board of Directors discusses the Company's approach to cybersecurity risk management with the Company's President.

companyName: Waterstone Financial, Inc.

ticker: WSBF


text: In order to help deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with a monthly data protection, cybersecurity, and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security, and educates employees on the importance of reporting all incidents immediately. We engage third-party vendors for 24/7 monitoring and comprehensive incident response measures. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Inozyme Pharma, Inc.


text: Our Board of Directors, or the Board, is responsible for overseeing our risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of our risk management program and our cybersecurity policies, processes, and practices. Our cybersecurity policies, standards, and controls are based on Soc2 Type 2 security criteria as defined by American Institute of Certified Public Accountants, periodic assessments using recognized National Institute of Standards and Technology's Cybersecurity Framework, and other applicable industry standards. Our cybersecurity program is fully integrated into our overall risk management system and processes. In general, we seek to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of our information systems or the information that we collect and store, by assessing, identifying, and managing cybersecurity issues as they occur.

companyName: CareDx, Inc.

ticker: CDNA


text: We design and assess our program based on guidance from the National Institute of Standards and Technology (NIST) and other industry sources. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use NIST publications and other sources as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Galera Therapeutics, Inc.

ticker: GRTX


text: Executive Management is responsible for managing the Information Security Program's operations for identifying and assessing external and internal risks to the security, confidentiality, and integrity of nonpublic information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information. Coastal's Information Security Officer ("ISO") is designated by the Board and is responsible for implementing and monitoring the Information Security Program. The ISO is a Senior Vice President and has served in such role since 2010. The ISO has over 38-years of financial institution experience, which includes, compliance, BSA, operations, physical security along with information security. The ISO provides an annual report to the Board on the overall status of the Information Security Program and on information technology incidents as necessary. The SVP of Technology also has responsibility for cybersecurity matters and reports to the Management Risk Committee, which consists of members of senior management. The Technology Subcommittee of the Management Risk Committee focuses on 3 pillars: Technology Strategy, InfoSec/Cyber, and Data.

companyName: COASTAL FINANCIAL CORP

ticker: CCB


text: The Adviser maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by us, from anticipated threats or hazards. The Adviser utilizes a variety of protective measures as part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software, among others.

companyName: BGO Industrial Real Estate Income Trust, Inc.


text: To reinforce our commitment to cybersecurity, we engage in regular third-party assessments and testing to validate and strengthen our defenses. Independent experts review our incident response and disaster recovery plans, evaluating our capacity to respond to cyber incidents and restore business continuity under adverse conditions. We further enhance our security posture by commissioning robust internal and external penetration tests conducted by third-party providers. These assessments rigorously evaluate our systems for potential vulnerabilities, enabling us to mitigate threats proactively and strengthen resilience against both known and emerging threats. By staying aligned with industry standards and engaging expert resources, we continuously adapt Inotiv's cybersecurity practices to meet today's challenges and anticipate future risks.

companyName: Inotiv, Inc.

ticker: NOTV


text: We rely extensively on various information systems and other electronic resources to operate our business . In addition, nearly all our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking, and accounting systems, use their own information systems and electronic resources. Any of these systems can be compromised, including through the employees, customers, and other individuals who are authorized to use them, and bad actors who use a sophisticated and constantly evolving set of software, tools, and strategies to do so. Moreover, the nature of our business as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue. For additional information see "Item 1A. Risk Factors—Operational Risks."

companyName: Princeton Bancorp, Inc.

ticker: BPRN


text: The underlying processes and controls of our cyber risk management protocol incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have undertaken an assessment of our networking risk management processes and controls to identify, quantify, and categorize material risks. In addition, we have developed a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: Twin Vee PowerCats, Co.

ticker: VEEE


text: The status of our cybersecurity program is regularly reported to our organization's board of directors. Our board of directors is actively involved in oversight of our cybersecurity risk management activities, and cybersecurity represents an important element of our organization's overall approach to risk management in the pursuit of its business goals and objectives.

companyName: Hyperfine, Inc.

ticker: HYPR


text: We also conduct tabletop exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation, and remediation strategies.

companyName: COVENANT LOGISTICS GROUP, INC.

ticker: CVLG


text: Our Cybersecurity Program includes the following processes: • Annual control reviews, annual policy reviews and annual investments in our security infrastructure; • Periodic testing of our information systems to assess our vulnerability to cyber risk, which includes targeted penetration testing and vulnerability scanning; • Collaborating with our internal audit team to evaluate the effectiveness of our information technology security program and communicating results to our executive officers; • Conducting a comprehensive information security and training program for our employees, including mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. As part of this commitment, we require our employees to acknowledge our Information Security policy each year. In addition, we have an established schedule and process for regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees; • Annually assess the Cybersecurity Program against the NIST Framework; • Maintaining business continuity, contingency and recovery plans to quickly react to cybersecurity incidents; • Conducting security assessments of all third-party service providers with access to personal, confidential or proprietary information before engagement and maintaining ongoing monitoring by reviewing system and organization controls reports, relevant cyber attestations, and other independent cyber ratings; • Retaining a third-party cybersecurity provider for emergency incident response services in the event of a serious information security breach; and • Maintaining cybersecurity risk insurance that could help defray the costs of an information security breach as a backstop to the Cybersecurity Program.

companyName: Sila Realty Trust, Inc.

ticker: SILA


text: Following this initial stage, we gather and update impact information and related documentation for such incidents. We use an incident classification matrix to determine the initial classification of a potential information security incident, which considers users, customers, and systems affected, the sensitivity of data at risk, and the potential business impacts to the Company including financial, legal, regulatory, operational, and reputation. The resulting classification of severity level "One," "Two," or "Three" identifies next steps for escalation and communication following the initial investigation of the potential incident. Upon escalation of an incident, per our Information Security Program, the IRT and ISO review and validate the initial determination of the priority of the incident prior to entering into subsequent investigative and response stages. Upon validation, the IRT and ISO will engage the Company's technology service provider to respond to the incident and notifications or communications are made to either additional personnel or any external entities. Depending on the specific details of any such incident, we may notify additional members of our management team, our board of directors, the Audit Committee, state and federal regulators, technology service providers, or the SEC. The timing of such communications varies based on the details of a particular incident and applicable regulations governing such disclosure. Following this classification and communication stage, we enter the recovery stage to determine containment and a response to the incident, the Company's technology service provider assigns technical staff to address such incident, implement containment, eradicate the incident source, and recover from such incident. Following any such incident and as determined by the Security Incident Forms, we engage in predefined follow-up activities to communicate with law enforcement and notify impacted third parties and customers, as appropriate, in addition to further investigating the cause of the incident, documenting takeaways, and engaging in remediation.

companyName: Community West Bancshares

ticker: CWBC


text: Access to data on the Company's networks is granted only if needed for job functions. Data Security Analysts review changes to access to ensure they are authorized and appropriate.

companyName: WESTAMERICA BANCORPORATION

ticker: WABC


text: While we have experienced cybersecurity incidents in the past, we do not believe that any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business or financial condition. However, there can be no assurance that we will not suffer a significant event in the future that could materially affect our business, financial position, results of operations or cash flows. For more information on how cybersecurity risk may materially affect our business, financial positions, results of operations or cash flows, please refer to Part I, Item 1A. Risk Factors hereof.

companyName: ASTEC INDUSTRIES INC

ticker: ASTE


text: Board Oversight of Cybersecurity Risks The Board provides oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from our Chief Compliance Officer regarding the overall state of the cybersecurity programs of our Adviser, custodian, transfer agent and Administrator, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.

companyName: Muzinich Corporate Lending Income Fund, Inc.


text: We do not currently believe cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations, or financial condition; however, we could experience a cybersecurity incident that materially affects us in the future.

companyName: VAIL RESORTS INC

ticker: MTN


text: Our financial data and primary operational systems are hosted off-site in virtual cloud environments which get periodically backed up and can be restored in the event of a cybersecurity incident. Our music subscription service is managed by our content provider, Stingray Group, who processes payments, and our e-commerce website payment processing is handled by Shopify. We do not store sensitive customer credit card data within our IT systems.

companyName: Algorhythm Holdings, Inc.

ticker: RIME


text: Cybersecurity training is conducted on a regular basis and includes awareness campaigns, in-person training, and simulations. Users of TEP's information systems are required to comply with a comprehensive internal acceptable use policy.

companyName: TUCSON ELECTRIC POWER CO


text: We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats. These policies and processes are intended to protect the confidentiality, integrity, and availability of our critical information systems and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature ("Information Systems and Data").

companyName: SITIME Corp

ticker: SITM


text: Each hotel or operating asset within our portfolio is a standalone network. Therefore, if a security breach were to occur at one location, it is fully isolated from other properties or networks.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: Strategy and Management Oversight We have an enterprise risk management function at Zillow Group responsible for the oversight and assessment of ongoing and emerging risks to our business operations and the integrity of our data, including the impact of cybersecurity risks. Our enterprise risk management team maintains a steering committee that oversees and opines on our processes to identify, prioritize and assess key risks, including risks related to cybersecurity. The steering committee is composed of senior, cross-functional business leaders with visibility into our key risks. Such members have expertise in the areas of risk management, business strategy, information technology, cybersecurity, legal and compliance, finance, communications, and business products, among others. In partnership with risk owners, this steering committee monitors risk exposures and verifies that efficient and effective risk-management strategies or acceptance and notification criteria are in place. The steering committee meets at least quarterly and its activities are overseen by the Audit Committee of our Board of Directors ("Board").

companyName: ZILLOW GROUP, INC.

ticker: ZG


text: We recognize the importance of managing the material risks of cybersecurity threats, and we have implemented processes for identifying and assessing cybersecurity risks and incidents. We have also integrated these processes into our overall risk management system, including senior management's periodic reviews of cybersecurity risks or threats. Senior management oversees and works closely with our IT department to continuously review and evaluate cybersecurity risks in alignment with our business goals and needs.

companyName: Cytosorbents Corp

ticker: CTSO


text: The Company's Chief Information Security Officer is responsible for the assessment and management of material risks related to cybersecurity. Our CISO has over 20 years of experience in information security and security engineering at various technology and staffing companies. The CISO reports directly to the CIO, who has over 30 years of experience serving as Chief Information Officer, Director of IT, and other roles in corporate information technology at staffing and technology companies. In addition, the Company's Management Team and Cybersecurity and Privacy Governance Team is composed of individuals with collective decades of experience in information technology, data protection, threat response, emergency management, business continuity, and disaster recovery.

companyName: KELLY SERVICES INC

ticker: KELYA


text: To mitigate risk, we utilize (i) firewalls to protect our network perimeter and additional perimeters within the network as required, (ii) anti-malware software to protect all Computer Equipment, including but not limited to desktops, laptops, workstations, and servers, (iii) device scanning, alerts, and reporting, (iv) physical security, (v) security and application lifecycle security, (vi) security updates and backups, and (vii) vulnerability and risk assessments.

companyName: Clene Inc.

ticker: CLNN


text: The landscape of cyber threats is constantly evolving, making it increasingly challenging to effectively defend against them or implement sufficient preventative measures. We have observed a rise in the volume, frequency, and sophistication of cyber-attacks. To date, no risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise. See Item 1A "Risk Factors – Cyberattacks or other security incidents that disrupt our operations or compromise data, may expose us to liability, harm our reputation or otherwise adversely affect our business."

companyName: DZS INC.


text: The risk and evolving nature of cybersecurity threats, and not a previous cybersecurity incident, has led to the Company to devote significant time and resources to the development and implementation of the Information Security Program described above. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures will be fully implemented, complied with, or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, result of operations or financial condition. Please see Part I, Item 1A Risk Factors for further discussion of the risks associated with an interruption or breach in our information systems or infrastructure.

companyName: First Internet Bancorp

ticker: INBK


text: The Company has a dedicated CIO and an Information Security Director who are supported by a team of cybersecurity professionals (the "Cybersecurity Team") that are responsible for leading the company-wide cybersecurity program and risk mitigation efforts. The CIO, the Information Security Director, and Cybersecurity Team work across all organizations within the Company to protect the Company and its employees, customers and suppliers against cybersecurity risks. The CIO and Information Security Director have cybersecurity expertise as well as extensive experience in information technology strategy, operations, incident response, and business continuity.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: As of December 31, 2023, and through the date of this filing, we are not aware of any material cybersecurity incidents that have impacted the Company. However, we have been the target of cyber attacks and expect them to continue as cybersecurity threats have been rapidly evolving in sophistication and becoming more prevalent in the industry. We face risks of incidents, whether through cyber attacks or cyber intrusions through the Cloud, the Internet, phishing attempts, ransomware and other forms of malware, computer viruses, email attachments, extortion, and other scams. Although we make efforts to maintain the security and integrity of our information technology systems, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them, are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party vendors, will prevent breakdowns or incidents to our or our third-party vendors' systems that could adversely affect our business. For a discussion of these risks, see "Item 1A—Risk Factors—Information Technology and Cybersecurity Risks—We are dependent on information technology and our systems and infrastructure face certain risks, including from cybersecurity incidents and data leakage."

companyName: BRISTOL MYERS SQUIBB CO

ticker: BMY


text: There have not been any breaches at the Sponsor or the Trust during the year ended December 31, 2023. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.

companyName: Grayscale Ethereum Classic Trust (ETC)

ticker: ETCG


text: Our Board of Directors (our "Board") has charged the Audit Committee with oversight of the Company's identification, assessment and management of cybersecurity and data privacy risks. The Audit Committee receives quarterly updates from our Chief Information Security Officer ("CISO") and our Chief Information Officer ("CIO") regarding our cybersecurity program and actions taken to manage cybersecurity risk, which include risk identification and management strategies, consumer data protection, security programs, ongoing risk mitigation activities and results of third-party assessments and testing.

companyName: Bloomin' Brands, Inc.

ticker: BLMN


text: Our management also conducts a quarterly enterprise-wide risk assessment that considers a wide spectrum of risks facing the Company, including cybersecurity. Through these quarterly risk assessments, management informs the Audit Committee on the cyber risk landscape facing the Company and the Company's preparedness to manage such risk. The enterprise-wide risk assessment is a top-down risk assessment that leverages the assessments performed by cyber risk management.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: The Audit Committee, comprised solely of independent directors, oversees our enterprise risk management program and assists the board of directors in fulfilling its oversight responsibility with respect to our information security and technology risks (including cybersecurity), which are fully integrated into our enterprise risk management program. The Audit Committee reviews and discusses our information security and technology risks (such as cybersecurity), including our information security and risk management programs.

companyName: AbbVie Inc.

ticker: ABBV


text: At the Board level, Atkore's cybersecurity is overseen by a subset of the full Board of Directors, specifically the independent board members. This oversight includes a quarterly review of Atkore's cybersecurity program, including key program metrics, initiatives, and developments. In addition, in the event of a significant cybersecurity incident, Atkore's policy and process require engagement of, and consultation with, the Board of Directors.

companyName: Atkore Inc.

ticker: ATKR


text: Management and oversight As part of our cybersecurity program, we engage with external service providers in our continuing cybersecurity efforts. These providers assist us in evaluating and enhancing the effectiveness of our information security policies and procedures. The partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity policies and procedures are comprehensive, up-to-date, and aligned with regulatory requirements.

companyName: Trulieve Cannabis Corp.

ticker: TCNNF