text: The cyber risk management program falls under the responsibility of a third party IT consultant, who has cross-functional expertise in IT management, cybersecurity, and engineering with more than 30 years of experience (the "IT Consultant"), who reports directly to our Chief Financial Officer. Under the guidance of the IT Consultant, we have minimized our data footprint to keep our cyber risk low.

companyName: Avalon GloboCare Corp.

ticker: ALBT


text: Among management, our Chief Information Security Officer ("CISO"), together with our Chief Operating Officer ("COO"), is responsible for leading efforts to assess and manage cybersecurity risks. Our CISO has over 20 years of experience assessing and managing cybersecurity risk, including leading information security teams at complex web-based businesses, and has a Master's degree in Computer Information Systems and multiple professional and cybersecurity certifications, including CISM, CDPSE, CIPM, CIPT, and PMP. Our COO oversees, among other things, our company's technology strategy and architecture and the integration and delivery of technology into our operations and service offerings. Our COO has over 10 years of experience supervising teams in implementations of key internal- and external-facing technology systems. Prior to joining the Company, our COO worked at a multinational public technology company and led teams in solving operations problems with technology. Our COO has a Bachelor's degree in Chemical Engineering, a Master's degree in Business Administration and a Juris Doctorate.

companyName: Frontdoor, Inc.

ticker: FTDR

secItem: Item 1C


text: The Company's Information Security and Privacy teams reduce first and third-party risk by maintaining a proactive security posture aligned with current threats, detecting cybersecurity events and responding quickly, and building procedures to rapidly recover.

companyName: TRACTOR SUPPLY CO /DE/

ticker: TSCO


text: The Board, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least once each year, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the Company's Chief Information Security Officer.

companyName: A.K.A. BRANDS HOLDING CORP.

ticker: AKA


text: The Senior Information Technology and Enterprise Applications Manager notifies the Key Principals of our cybersecurity and information security posture as appropriate and the Key Principals are apprised of cybersecurity incidents deemed to have any relevant business impact. The Key Principals, Senior Information Technology and Enterprise Applications Manager, our Chief Financial Officer, Chief Accounting Officer, and our Executive Managing Principal maintain an open dialogue regarding emerging or potential cybersecurity risks. The Senior Information Technology and Enterprise Applications Manager keeps them appraised of updates on any significant developments in the cybersecurity domain, ensuring the Key Principals' oversight is both proactive and responsive.

companyName: ExchangeRight Income Fund


text: Our enterprise cybersecurity program aligns with the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) standards, among others. The program includes processes and controls for the deployment of new IT systems by the Company and controls over new and existing system operations. We, or third parties we contract with, monitor and conduct regular testing of these controls and systems, including vulnerability management through active discovery and testing to regularly assess patching and configuration status. In addition, we require our employees to complete annual cybersecurity training, and we regularly conduct simulated phishing and cyber-related communications. Incident Response.

companyName: Vuzix Corp

ticker: VUZI


text: We evaluate the risks associated with technology and cybersecurity threats and monitor our information systems for potential weaknesses. We review and test our information technology system on an as-needed basis and also utilize internal team personnel to evaluate and assess the efficacy of our information technology system and enhance our controls and procedures. The results of these assessments are reported to our Audit Committee and, from time to time, our Board of Directors.

companyName: Reborn Coffee, Inc.

ticker: REBN


text: We have implemented additional technical and procedural safeguards over time to strengthen our security posture, including enhanced incident response protocols and employee awareness training. Although cybersecurity threats in the last fiscal year have not materially affected the Company's business strategy, results of operations or financial condition, there can be no assurances that future cybersecurity incidents, which are unavoidable, will not materially affect our results of operations, including our business strategy, results of operations, or financial condition. Additional information on cybersecurity risks we face can be found in Part I, Item 1A. "Risk Factors - Unauthorized or improper disclosure of personal information, breach of privacy, whether inadvertent or as the result of a cyber-attack or improperly by our employees, has resulted in liability and could harm us." which should be read in conjunction with the foregoing information.

companyName: IBEX Ltd

ticker: IBEX


text: On July 26, 2023, the SEC adopted a final rule requiring registrants to disclose certain information related to the registrants' policies regarding cybersecurity risk management and strategy in addition to current policies regarding cybersecurity governance.

companyName: Microvast Holdings, Inc.

ticker: MVST


text: Xcel Energy's cybersecurity policies, standards, practices and readiness are regularly assessed by third-party consultants. These partners are engaged to perform independent penetration testing and other security related services to assist in the prevention, detection, monitoring, mitigation and remediation of cybersecurity incidents and risks. The results of these assessments are communicated to management and the Board of Directors by the Chief Security Officer.

companyName: XCEL ENERGY INC

ticker: XEL


text: The Enterprise Risk Management Committee ("ERMC") of the Board has primary responsibility for overseeing the Company's comprehensive Enterprise Risk Management program. The Enterprise Risk Management program assists senior management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. Cybersecurity matters and assessments are regularly included in both ITC and ERMC meetings.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: Our Chief Financial Officer provides annual briefings to the audit committee regarding the Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. The audit committee provides regular updates to the board of directors on such reports.

companyName: LENZ Therapeutics, Inc.

ticker: LENZ


text: Crucially, the Company, or its third-party service providers it may rely on, may not be able to design or implement technical or organizational controls comprehensively, consistently or effectively as intended to protect the confidentiality, integrity or availability of systems and data. Because the Company utilizes a risk-based strategy, based on professional judgment and analysis of the risks, it is possible that the Company may underappreciate or not recognize a specific risk. Moreover, even the best designed and implemented security controls may not eliminate cybersecurity incidents.

companyName: United Airlines Holdings, Inc.

ticker: UAL


text: Chief Information Security Officer. In addition to establishing the SCC and other committees, we designated a Chief Information Security Officer (CISO) to oversee all aspects of our IS policies, procedures, and controls. Our CISO reports to our Senior and Executive Management Committee, the SCC, the Risk Committee, and the Chairman of the Board. At least annually, the CISO presents all of our IS policies to the Board. The CISO is also tasked with maintaining an effective Security Awareness Program and providing training to our management, Board, and employees on an annual basis. Additionally, the CISO meets with our Audit Committee on a quarterly basis to inform them of material cybersecurity-related regulatory updates and with our full Board on a monthly basis to discuss and provide pertinent regulatory information.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Our Chief Information Officer has more than 20 years of cybersecurity and information technology experience and she has served as the Chief Information Officer for multiple technology companies. Similarly, the members of the ERM Committee possess significant risk management experience obtained by their collective years of experience at Bloom and other companies of similar or greater complexity.

companyName: Bloom Energy Corp

ticker: BE


text: In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. In addition, we regularly review cybersecurity trends and, partially as a result of our prior cybersecurity exposure, have moved some of our internal servers to off-site locations.

companyName: MANHATTAN BRIDGE CAPITAL, INC

ticker: LOAN


text: We maintain a team of internal and external information technology specialists who are responsible for the design, implementation, and operation of our information technology ecosystem and cybersecurity governance processes. We engage with certain external parties, including consultants, computer security firms and risk management advisors, peer companies, and industry groups in an effort to enhance our cybersecurity oversight and risk management strategy. We also use security technologies, including third-party solutions and monitoring tools that are designed to identify and mitigate cybersecurity risks. Further, we regularly engage third parties to conduct penetration testing, security assessments and tabletop exercises. We also engage a virtual chief information security officer ("vCISO") to support and advise on our cybersecurity program. We have a process to consider the internal risk oversight programs of critical third-party service providers before engagement, including through security questionnaires and contractual requirements, as appropriate. In addition, in an effort to deter and detect cyber threats, we have implemented an annual training program to provide employees with data protection, cybersecurity and incident response and prevention training.

companyName: Scholar Rock Holding Corp

ticker: SRRK


text: Processes for the Identification of Cybersecurity Threats Under the guidance of the Information Security Core Committee and the CISO, we have adopted a cybersecurity risk management program that addresses, among other areas: • Identification of assets at risk from cybersecurity threats; • Identification of potential sources of cybersecurity threats; • Assessment of the status of protections in place to prevent or mitigate cybersecurity threats; and • Given that landscape, how to manage cybersecurity risks.

companyName: ORRSTOWN FINANCIAL SERVICES INC

ticker: ORRF


text: We design and assess our program based on multiple cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and ISO 27001. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF, ISO 27001 and other frameworks as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Zeta Global Holdings Corp.

ticker: ZETA


text: We have adopted a cloud-first strategy which is a foundational element to our overall cybersecurity posture. For essential systems, we utilize SaaS-based software partners who annually conduct Statement on Standards for Attestation Engagements SOC 1 or SOC 2 assessments, as appropriate, based on functional use within our company. Based on the nature of services provided by our technology partners, our third-party risk management process may include: Reviewing cybersecurity practices of such provider; Contractually obligating the provider to share detailed results of cybersecurity assessments on an annual basis;

companyName: JBG SMITH Properties

ticker: JBGS


text: Our information security program strives to protect the confidentiality, integrity and availability of information and information systems and is aligned to the Company's business and risk management strategies. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk. The information security program includes policies and standards that define the risk assessment procedures, reporting and an incident response plan. Key elements of our cybersecurity risk management program include: • IT risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • Information Security Department responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to a cybersecurity incident; • Cybersecurity Assessment Toolkit (developed by the FFIEC) is assessed annually, tracks program maturity, changes in risk profile, and reviews security controls critical to reduce cybersecurity risk. Results are presented to and approved by the Board. We are currently in the process of transitioning to the Cybersecurity Framework developed by the National Institute of Standards and Technology as the FFEIC Cybersecurity Assessment Toolkit will sunset on August 31, 2025; • Ransomware Assessment Toolkit (developed by the Bankers Electronic Crimes Task Force, state bank regulators and the U.S. Secret Service) is assessed biannually to capture any gaps and address any potential control deficiencies; • training and awareness programs for employees that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • a cybersecurity incident response plan that includes procedures for responding to a cybersecurity incident; and defines escalations to senior management and the Board, as well as required notifications and timeframes to customers and regulatory authorities, • a third-party risk management process for service providers, suppliers, and vendors, including those external service providers we engage in our cybersecurity risk management processes.

companyName: SOUTHSIDE BANCSHARES INC

ticker: SBSI


text: The cybersecurity framework utilized by the Corporation is based on recommendations from the National Institute of Standards and Technology (NIST), ISO/IEC 27001 & 27002, Federal Financial Institutions Examination Council (FFIEC), industry standards and best practices, and other applicable regulatory guidance. We maintain robust cybersecurity policies and procedures identify risks and mitigate where feasible. Policies and procedures address; vendor management and third-party risk, incident response, disaster recovery and business continuity, electronic banking, data classification and retention. The Corporation's information security program is led by the Chief Technology Officer (CTO) in conjunction with the Chief Risk Officer (CRO) having over 50 years of combined experience in financial services risk management, and information security. Their experience includes incident response, vendor management, disaster recovery and business continuity, breach mitigation as well as relevant professional certification. Along with the CTO and CRO, the Executive Enterprise Risk Management Committee (EERM)and the Board Enterprise Risk Management Committee (BERM) are responsible for oversight of the Corporation's cybersecurity and information security program and regularly reviews and evaluates information security and cybersecurity risks provided by management. Key risk indicators (KRIs) are regularly reported to the EERM Committee and BERM for review on a quarterly basis or as needed. The CRO provides updates to the Board of Directors multiple times a year and as needed. This includes facilitating training for the Board on cybersecurity risks and threats. The Board of Directors is also responsible for reviewing and approval policies critical to the information security program annually.

companyName: FRANKLIN FINANCIAL SERVICES CORP /PA/

ticker: FRAF


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the NIST, the International Organization for Standardization, and other applicable industry standards. Our cybersecurity program in particular focuses on the following key areas: • Incident Response: We have an Incident Response Plan ("IRP") to address cybersecurity incidents as defined by Item 106 of Regulation S-K. The IRP includes as a core component an Incident Response Team ("IRT") that utilizes guidelines identified in the IRP to identify, assess, and disclose cybersecurity incidents as applicable. The IRT consists of a core team, which includes representation from IT, Legal, and Human Resources, and an extended team, which includes representation from Enterprise Risk Management, Communications, Investor Relations, Internal Audit, Legal, Accounting, and External Reporting. The core team is involved in all incidents that are classified as significant, requiring a response from the IRT, and it involves components of the extended team as applicable. The IRT allows for broad representation of various areas of expertise for use in executing the IRP. The IRT meets monthly to evaluate the effectiveness of our cybersecurity risk management processes and procedures, including the IRP. The IRP is designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner. • Defense and Monitoring: We work to protect our computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks. We utilize data analytics to detect anomalies and search for cyber threats. Our Cybersecurity Operations Center provides comprehensive cyber threat detection and response capabilities and maintains a 24x7 monitoring system which complements the technology, process, and threat detection techniques we use to monitor, manage, and mitigate cybersecurity threats. From time to time, we engage third party consultants or other advisors to assist in assessing, identifying, and/or managing cybersecurity threats. We also periodically use our Internal Audit function to conduct additional reviews and assessments. • Insider Threats: We maintain an insider threat program designed to identify, assess, and address potential risks from within our Company. Our program evaluates potential risks consistent with industry practices, customer requirements, and applicable law, including privacy and other considerations. • Third Party Risk Assessments: We conduct information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties, and our standard terms and conditions contain contractual provisions requiring certain security protections.

companyName: Sensata Technologies Holding plc

ticker: ST


text: We employ a Director of Information Technology who works exclusively on information technology and cybersecurity matters and has over 28 years of related experience. We employ a Director of ESG and Corporate Operations who spends part of her business time on information technology matters, specifically business applications, and has 11 years of related experience. Both employees report to our Chief Operating Officer.

companyName: LXP Industrial Trust

ticker: LXP


text: Key features of our cybersecurity risk management program include: • Designated security risk team. Our security risk management team is responsible for maintaining Okta's cybersecurity risk management framework and risk assessments and tracking risk mitigation efforts. This team, together with our enterprise risk management team, monitors and regularly reports on our cybersecurity risk profile. Our internal audit team partners with these teams to provide input on the overall effectiveness of Okta's security risk governance and management processes. • Risk assessments. We periodically perform enterprise-wide assessments to stay informed about critical security risks. Okta's functional teams also assess risks associated with their specific activities, with supervision by the security risk management team. Functional team risk assessments follow an established framework that includes information-gathering from internal and external sources to identify risks, and evaluating the adequacy of controls to mitigate those risks. We have a management-level risk oversight committee, led by internal audit and security risk management personnel, that meets quarterly with other internal business leaders to review the results of these enterprise-wide and functional team risk assessments and evaluate the adequacy of any proposed mitigation plans. • Incident response planning. Okta's cybersecurity incident response plan outlines the processes and procedures for responding to, remediating and resolving a security incident, and defines the roles and responsibilities of Okta personnel in responding to such incidents. • Security awareness training. We require our employees and contractors to complete general cybersecurity awareness training at least annually. These training sessions advise on how to protect Okta, our information systems and data, as well as our customers' systems and data. From time to time we may also require supplemental cybersecurity training for certain members of our workforce depending on their job responsibilities. • Third-party risk management. We require high risk third-party vendors, suppliers and service providers to undergo a cybersecurity risk assessment prior to contracting with Okta. Certain third parties are monitored and reassessed on an ongoing basis, depending on their level of risk or in the event of changes to their products or services.

companyName: Okta, Inc.

ticker: OKTA


text: The Company's Director of Information Security ("CISO"), reporting to the Chief Information Officer ("CIO"), is the leader of the Company's cybersecurity team. The CISO is responsible for assessing and managing the Company's cybersecurity program, informs the CIO and other senior management as appropriate regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. Our CISO and CIO have decades of collective experience managing information technology and cybersecurity functions, both at the Company and in prior positions at large, Fortune 500 global businesses. Management also periodically evaluates the experience of the Company's entire cybersecurity team to ensure adequate coverage across all eight key knowledge domains identified by the Certified Information Systems Security Professional certification.

companyName: Andersons, Inc.

ticker: ANDE


text: Cybersecurity threats have the potential to negatively impact companies of all sizes and complexities. Our normal business operations could be severely disrupted by cyberattacks, both against our own information systems as well as those hosted and managed by our third-party partners. The loss or disclosure of sensitive data as a result of cyberattacks could have a material impact on our business. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A, Risk Factors of this Form 10-K.

companyName: SOUTH PLAINS FINANCIAL, INC.

ticker: SPFI


text: Our Board oversees management's implementation of our cybersecurity risk management methodology. Our Board receives periodic updates from our Chief Executive Officer and more frequently as needed, regarding the overall state of our cybersecurity preparedness, information on the current threat landscape, and material risks from cybersecurity threats and cybersecurity incidents. The Board and our management team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from third-party service providers.

companyName: BioCorRx Inc.

ticker: BICX


text: CTS uses a managed security services provider (MSSP) and other technologies to collect alerts and security audit logs, monitor and assess cybersecurity threat intelligence, and take actions to help us prevent, detect, mitigate and remediate cybersecurity incidents.

companyName: CTS CORP

ticker: CTS


text: The CFO works in conjunction with the Chief Technology Officer ("CTO") to oversee the Information Security Team and the operation of the Cybersecurity Program. Our Information Security team in conjunction with the CTO have an average of 15 years of professional IT and software development management experience, including in the areas of incident response, vulnerability management, network security administration and other governance, risk and compliance areas.

companyName: ITERIS, INC.


text: The Board exercises its cyber risk oversight primarily through updates provided by executive management, our CIO, and our CISO. Our CIO and CISO have expertise in the areas of information security and cybersecurity, through decades of management, prominent cybersecurity training, and real-world experience. Intimate knowledge of best practices, incident response, technologies, and IT and business processes enable the management team to be effective in their approach.

companyName: CSG SYSTEMS INTERNATIONAL INC

ticker: CSGS


text: Our global cybersecurity and privacy program is managed by our Chief Technology and Information Security Officer ("CISO"), Vice-President of Global IT Security, Global Chief Privacy Officer ("CPO"), and Chief Information Officer ("CIO"). We have also established a Cybersecurity and Privacy Council, which comprises our senior management team, including our CEO. The Cybersecurity and Privacy Council meets on a quarterly basis with the CISO, CPO and CIO to keep our CFO, General Counsel and other executive leadership informed of cybersecurity activities and new risks and requirements. The objective of this council is to review, discuss, and manage cybersecurity and privacy risks and threats, prioritize risks, monitor risk mitigation progress, advise and update on the evolving legal landscape, as well as provide visibility into ongoing activities and programs.

companyName: CRAWFORD & CO

ticker: CRD-A


text: Our Board of Directors oversees cybersecurity risk. Cybersecurity reviews by the Board are scheduled to occur at least quarterly, or more frequently as determined to be necessary or advisable. Presentations to the Board of Directors are made by senior management, including our Chief Information Security Officer ("CISO"), our EVP of Microsoft Security, and the head of our Customer Security and Trust organization. The presentations address topics such as cybersecurity threats, incidents, top risks and related remediation efforts, results from internal and third-party assessments, progress towards risk-mitigation goals, the functioning of our incident response program, regulatory developments, and digital diplomacy efforts. In addition, we have an escalation process in place to inform senior management and the Board of significant issues. Cybersecurity issues are also considered during separate Board meeting discussions regarding important matters like ERM, audit issues, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.

companyName: MICROSOFT CORP

ticker: MSFT


text: Our Virtual CISO will report quarterly to the Audit Committee of the Board of Directors ("the "Audit Committee"), which is responsible for overseeing the Company's cybersecurity risk management program and cybersecurity risks. As part of that report, our Virtual CISO is expected to cover topics such as (i) an overview of our overall cybersecurity strategy and posture, (ii) results and recommendations from cybersecurity risk assessments and audits, (iii) vulnerabilities in our information systems, (iv) progress towards pre-determined risk-mitigation goals, (v) identified and potential cybersecurity risks and threats, (vi) cybersecurity incidents of certain impact in accordance with the Company's cybersecurity policies, and (vii) programs related to mitigation of cybersecurity risks and potential threats, among other things. The Audit Committee reports to the full Board of Directors regarding its activities, including reports that it receives from our CISO.

companyName: Compass, Inc.

ticker: COMP


text: We follow an annual IT Security assessment based on the IASME Cyber Essentials framework which is approved by the UK government Cyber Security NCSC and implement policies and controls based on the understanding of ISO 27001 and NIST framework which assist the governance process.

companyName: Pacific Green Technologies Inc.

ticker: PGTK


text: Nevertheless, in order to continue meeting Registrant's technological business needs and as more vendors build solutions in the cloud, Registrant expects to further expand its use of cloud-computing environments. As such, Registrant expects risks from cyberattacks and data breaches to increase due to the growth of its technological footprint in the cloud environments.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: The audit committee receives periodic reports from our VP of IT concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. Under our incident response plan, certain incidents would also be reported to the board.

companyName: Arcus Biosciences, Inc.

ticker: RCUS


text: The Managing Director – Enterprise Technology and Manager, Cybersecurity have extensive experience in technology and cybersecurity, respectively. The cybersecurity team of Onex Corp. is responsible for all aspects of cyber and physical security across Onex Corp.

companyName: Onex Direct Lending BDC Fund


text: As of September 30, 2024, the Company has not identified any cybersecurity threats, including previous incidents, that have materially impacted our business strategy, results of operations, or financial condition. This assertion signifies our diligent efforts in managing and mitigating cybersecurity risks, contributing to the stability and continuity of our operations.

companyName: DFP HOLDINGS Ltd


text: ETST recognizes the growing importance of cybersecurity. Recently, the company hired Chris Rose as the Chief Technology Officer (CTO) on April 1st, 2024. Chris assumes the primary responsibility for overseeing our cybersecurity risk exposure. This includes evaluating, assessing, and enhancing cybersecurity practices across the organization.

companyName: Earth Science Tech, Inc.

ticker: ETST


text: Our Board actively oversees our enterprise risk management program. Our Board's role in risk oversight is consistent with our overall leadership structure: management is responsible for assessing and managing our short- and long-term risk exposures, and our Board and its committees provide effective oversight through independent monitoring of strategic risks and regularly scheduled meetings with management to discuss in-depth the strategic objectives of the Company and associated risks. In order to maintain effective Board oversight across the entire enterprise risk management program, the Board delegates to the individual committees certain elements of its oversight function. The Audit Committee of the Board has oversight of cybersecurity risk and receives regular updates on any developments from our Chief Information Security Officer ("CISO"), including biannual updates on strategies and action plans, with periodic reports provided to our full Board.

companyName: IQVIA HOLDINGS INC.

ticker: IQV


text: Our cybersecurity program is designed to assess, identify and manage material risks from cybersecurity threats, and is a component of our overall enterprise risk program. Our cybersecurity program is based on the National Institute of Standards and Technology Cybersecurity Framework, version 2.0 ("NIST CSF"). We conduct regular scans, penetration tests, and vulnerability assessments to identify potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage material risks from cybersecurity threats include potential threats associated with third party service providers, including cloud-based platforms.

companyName: ADVANCED DRAINAGE SYSTEMS, INC.

ticker: WMS


text: In addition, the Company's vendor management program addresses cybersecurity risks associated with its use of third-party service providers including suppliers, software and cloud-based service providers. The Company proactively evaluates the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, threat intelligence during contracting, and vendor selection processes. Security issues are documented and tracked, and periodic monitoring of third parties is conducted in an effort to mitigate risk.

companyName: MP Materials Corp. / DE

ticker: MP


text: On a day-to-day basis and from a project perspective, the Security and Compliance Team undertakes the following activities: • Builds and reviews reports on newly identified security threats. • Monitors various internal security toolsets including EDR (Endpoint Detection and Response), email security and logging from company firewalls and other security related systems and takes action to prevent or resolve incidents identified by monitoring. • Ensures that appropriate vendor patches/configurations are applied to the various internal systems that operate to maintain a secure environment. • Works with various teams with the IT department to ensure that company servers and data are properly backed up and that compliance requirements and security best practices are following during new system implementations. • Deploys and tunes various security and monitoring platforms. • Manages the North America Annual PCI (Payment Card Industry) review and consults with Zumiez international entities regarding PCI. • Provides evidence gathering for, and conducts walk throughs with, internal and external audit teams for internal control over financial reporting related to Section 404 of the Sarbanes-Oxley Act of 2002 (SOX Controls). • Maintains a system of security policies and procedures within the IT department related to cybersecurity and compliance requirements, primarily related to PCI compliance and SOX Controls.

companyName: Zumiez Inc

ticker: ZUMZ


text: We are not aware of any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We can give no assurance that we have detected or protected against all cybersecurity threats or incidents. We are subject to a variety of cybersecurity risks, which could have a material adverse effect on our business, financial condition, and results of operations. See the "Risks Related to Intellectual Property and Data Security" section of Item 1A. Risk Factors for additional discussion on risks affecting our information systems.

companyName: ESTABLISHMENT LABS HOLDINGS INC.

ticker: ESTA


text: The Company maintains a documented information security program, under the supervision of its Chief Information Officer ("CIO"), that is designed to protect the infrastructure, information systems, and the information in Company systems from unauthorized access, use, or other malicious acts by enabling the organization to identify risks, implement protections, and detect and respond to cybersecurity events. Our information security program covers multiple aspects of security management, including, but not limited to: data handling and classification; user access controls and management; business continuity and disaster recovery; configuration management; asset management; risk assessments; data disposal; record retention; information security incident response; vulnerability and patch management; network security and monitoring; physical and environmental controls; data privacy; vendor and third party risk management; multi-factor authentication; and cybersecurity awareness training. The CIO has over 25 years of professional, cross-discipline information technology experience in various industries including real estate, financial services, government, and hospitality. The Vice President of Cybersecurity, reporting directly to the CIO, has over 18 years of information technology experience and is a Certified Information Systems Security Professional ("CISSP"). Both have been with the Company for over a decade.

companyName: SAUL CENTERS, INC.

ticker: BFS


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST") and the System and Organizational Controls ("SOC2"), as well as information security standards issued by the International Organization for Standardization, including ISO 27001 and ISO 27002. We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Stereotaxis, Inc.

ticker: STXS


text: Our IT Steering Committee, which consists of our CEO. CFO, and other senior leadership employees, is responsible for coordinating our day-to-day management of cybersecurity risk. Each quarter, the IT Steering Committee receives reports from the CTO and Director of Information Technology on our cybersecurity program performance and emerging threats and incidents. The IT Steering Committee makes recommendations intended to ensure that hawse have adequate resources to address information technology risks.

companyName: AstroNova, Inc.

ticker: ALOT


text: As a financial institution (or third parties it relies on) we may not be able to fully, continuously, and effectively, implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate, and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.

companyName: BYLINE BANCORP, INC.

ticker: BY


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and critical data, including intellectual property, clinical trial data, and other confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Kezar Life Sciences, Inc.

ticker: KZR


text: We use a variety of third-party service providers to support and execute on our Security Program. These third parties provide cybersecurity consulting services, cybersecurity software, penetration testing, audits, and other professional services to aid us in identifying, assessing, and managing risks from cybersecurity threats.

companyName: SPS COMMERCE INC

ticker: SPSC


text: Activities to assess vulnerabilities including penetration testing, red teaming, tabletop exercises, and phishing and social engineering drills Engagement with law enforcement and U.S. government agencies, directly and through memberships in various cybersecurity intelligence and risk sharing organizations to help us stay informed about evolving threats Utilization of third-party experts to test, validate, and strengthen our plans, practices, and policies Technology team collaboration sessions to share information across different teams, geographic areas, and areas of responsibilities Assessing and managing cybersecurity risks arising out of the use of third-party technology and services, including pre-contract diligence, imposition of contractual obligations, and performance monitoring Learnings from these activities are used to inform our training, guide our incident response preparedness and enhance our plans and processes. To further inform our cybersecurity program, we also participate in discussions with third-party service providers who have experienced cybersecurity incidents.

companyName: CONAGRA BRANDS INC.

ticker: CAG


text: We regularly collaborate with the Company's internal audit department and third parties with security and infrastructure expertise for review and evaluation of the Company's cybersecurity risk program and the associated IT control environment. We engage third-party service providers to perform annual external penetration testing, disaster recovery testing, and security incident simulations.

companyName: Texas Pacific Land Corp

ticker: TPL


text: Management Oversight The Information Security Program is overseen by our Information Security Steering Team, which provides cross-functional program oversight and maintenance and includes members from the Information Technology, Internal Audit, Legal, and Risk Management Departments. This team is also responsible for developing, implementing, and maintaining our information security policies and procedures.

companyName: UNIVERSAL CORP /VA/

ticker: UVV


text: Our cybersecurity team, led by the CSAO, is responsible for coordinating and executing on the cybersecurity response procedures and for seeking assistance from other Partnership stakeholders and external advisors. Our cybersecurity team includes the CSAO and IT leadership. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our cybersecurity team includes professionals with deep cybersecurity expertise across multiple industries. The CSAO has over 20 years of audit, risk management and cybersecurity experience covering the energy, pipeline, utilities, manufacturing, and financial services industries.

companyName: NATURAL RESOURCE PARTNERS LP

ticker: NRP


text: We have processes in place designed to protect our information systems, data, assets, infrastructure and computing environments from cybersecurity threats and risks while maintaining confidentiality, integrity and availability. These enterprise-wide processes are based upon policies, practices and standards that guide us on identifying, assessing and managing material cybersecurity risks and include, but are not limited to: • placing security limits on physical and network access to our information technology ("IT") and operating technology ("OT") systems; • employing internal IT and OT controls designed to detect cybersecurity threats by collecting and analyzing data in our centralized cybersecurity operations center; • utilizing layers of defensive methodologies designed to facilitate cyber resilience, minimize attack surfaces and provide flexibility and scalability in our ability to address cybersecurity risks and threats; • providing cybersecurity threat and awareness training to employees and contractors; • limiting remote network access to our IT and OT network environments; and • assessing our cybersecurity resiliency through various methods, including penetration testing, tabletop exercises with varying scenarios and participants ranging from individuals on our operations teams to executive leadership, and analyzing our corporate cybersecurity incident response plan.

companyName: Marathon Petroleum Corp

ticker: MPC


text: Our CIO has reviewed the standards created by the National Institute of Standards and Technology and has incorporated their approaches where appropriate. We conduct internal and external risk assessments.

companyName: HireQuest, Inc.

ticker: HQI


text: For a discussion regarding risks from cybersecurity threats, see our risk factors, including the risk factors titled "–Any major disruption or failure of our information technology systems or websites, or our failure to successfully implement upgrades and new technology effectively, could adversely affect our business and operations", "–Cybersecurity risks could adversely affect our business and disrupt our operations", "–Our business is subject to the risk of earthquakes, fire, power outages, floods, hurricanes, public health crises, ransomware and other cybersecurity attacks, labor disputes, and other catastrophic events, and to interruption by man-made problems such as terrorism and international geopolitical conflicts", "–We collect, store, process, and use personal data and other Member data, which subjects us to legal obligations and laws and regulations related to security and privacy, and any actual or perceived failure to meet those obligations could harm our business", "–Our growing use of artificial intelligence and machine learning technologies may present additional risks and challenges, which could result in reputational and competitive harm, legal liability and adversely affect our results of operations ", under the heading "Risk Factors—Risks Related to Our Business" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: PELOTON INTERACTIVE, INC.

ticker: PTON


text: For a description of the risks from cybersecurity threats that may materially affect our business and how they may do so, see the section titled "Risk factors" in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of third parties with whom we work, are compromised, now or in the future, we could experience adverse consequences resulting from such a compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."

companyName: Cytek Biosciences, Inc.

ticker: CTKB


text: Oversight of Third-Party Risk Because we are aware of the risks associated with third-party service providers, we implement processes to oversee and manage these risks. We conduct security assessments of critical third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes regular assessments by our Chief Information Officer ("CIO") and cybersecurity staff and advisors. This approach is designed to mitigate risks related to data breaches or other security incidents involving third-parties.

companyName: Liberty Energy Inc.

ticker: LBRT


text: Framework for Cybersecurity Controls We have implemented risk-based controls to protect our networks, computers and data. To this end, we utilize the Center for Internet Security (CIS) version 8.0 framework, which is comprised of eighteen critical security controls. The CIS framework is based on the COSO (Committee of Sponsoring Organizations on the Treadway Commission) and NIST (National Institute of Standards and Technology) frameworks and provides a highly actionable way to implement those frameworks and maps directly to other compliance requirements relevant to us, including PCI compliance and SOX controls (briefly discussed above).

companyName: Zumiez Inc

ticker: ZUMZ


text: We have implemented and maintain a comprehensive information security program designed to protect the confidentiality, integrity, and availability of our critical systems and information, as well as to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our systems and processes are assessed by independent third parties for compliance with: the International Standard Organization ("ISO") 27001; System and Organization Controls ("SOC") 2, Type 2; and Payment Card Industry Data Security Standards ("PCI DSS") Level 1.

companyName: Red Violet, Inc.

ticker: RDVT


text: Impact of Risks from Cybersecurity Threats As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For more information on our cybersecurity related risks, see "Item 1A. Risk Factors" for additional information.

companyName: HighPeak Energy, Inc.

ticker: HPK


text: The Company's policies require it to maintain and control an inventory of the enterprise assets throughout their life cycle, including end-user devices, network devices, servers, operating systems and applications used throughout the Company. These assets are subject to secure configuration requirements as well as data protection requirements before they may be used in operations. Once appropriate configuration requirements are met, access to these assets is based on account management procedures, which include determining appropriate ownership of the account and monitoring controls over accounts using administrator privileges. Access is generally provisioned on the "least privilege" principle, meaning that a user is given the minimum levels of access or permissions needed to perform their job functions, and consistent with the requirements of the role being provisioned. On a continuous basis, these assets are monitored to assess and track vulnerabilities within the Company's infrastructure. Any identified vulnerabilities are remediated on a scheduled basis in alignment with an assessment of the associated risk. Upon termination or transfer of the user, processes are in place to remove user access from these assets, and additional monitoring controls are in place to certify access on a recurring basis.

companyName: EVANS BANCORP INC


text: The CISO is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents. With the support of legal, the CISO is responsible for global regulatory compliance related to cybersecurity regulations and industry standards. The CISO also advises on the implementation of cybersecurity risk management in the Company's products and services as they are being developed.

companyName: MATTHEWS INTERNATIONAL CORP

ticker: MATW


text: Additionally, our Audit Committee, which consists solely of independent trustees, is responsible for overseeing cybersecurity risks and related initiatives. Our Audit Committee reviews our enterprise risk and cybersecurity risks. It also reviews the steps our Advisor has taken to protect against threats to our information systems and security and receives updates on cybersecurity on a quarterly basis.

companyName: Net Lease Office Properties

ticker: NLOP


text: Stitch Fix views its cybersecurity strategy through a multi-pronged lens encompassing prevention, detection, and response to ensure holistic coverage of our Information Systems and Data, along with the environments in which they operate.

companyName: Stitch Fix, Inc.

ticker: SFIX


text: As part of our selection process for certain third-party service providers, we evaluate components of their cybersecurity risk management programs using various factors. We engage third-party providers to provide ongoing threat monitoring, mitigation strategies, updates on emerging trends, security assessments, and penetration testing. We also receive updates from law enforcement and industry groups on emerging cybersecurity trends and the latest threats, and we have standing engagements with incident response experts.

companyName: SKYWORKS SOLUTIONS, INC.

ticker: SWKS


text: Cyber Security Plan We have implemented various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature (including without limitation tenant and property related data) ("Information Systems and Data").

companyName: NETSTREIT Corp.

ticker: NTST


text: Our technology and cybersecurity program focuses on the defense, rapid detection and rapid remediation of cybersecurity threats and incidents. Our program includes systems and processes designed based on defense-in-depth and zero-trust architectural principles and that are intended to provide the control capabilities set forth in NIST's 800-53 Rev 5, Security and Privacy Controls for Information Systems and Organizations. Our program also includes cybersecurity policies and a crisis response and management plan that is intended to allow rapid management and response and appropriate communication of cybersecurity threats and incidents.

companyName: BIOGEN INC.

ticker: BIIB


text: The Company's Vice President of Information Technology and Engineering leads the overall cybersecurity strategy and risk management program. This includes overseeing risk assessments, developing security policies and procedures, and managing the IT security team. See Item 10, Directors, Executive Officers and Corporate Governance, for more detail on his education and experience. Senior executives, including the Company's CEO and CFO, integrate cybersecurity risks into the overall business strategy and financial planning.

companyName: KEWAUNEE SCIENTIFIC CORP /DE/

ticker: KEQU


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes an initial assessment by our Director, Information Technology and IT team, and on an ongoing basis of a few key high-risk third-party systems by our security engineers. We also rely upon certain third-party system providers, including cloud and non-cloud programs provided by software developers such as Microsoft Corporation, Blackline Systems, Inc., Workiva, Inc., and others, to review and notify their customers of any data breach. This approach, both internal and reliance on external review notification, is designed to mitigate risks related to data breaches or other security incidents originating from third- parties.

companyName: Energy Recovery, Inc.

ticker: ERII


text: Key's Deputy CISO leads the Corporate Information Security function, including the Cyber Defense Center, Identity & Access Management Operations, Information Security Governance, and Security Architecture and Engineering.

companyName: KEYCORP /NEW/

ticker: KEY


text: The Audit Committee of our Board of Trustees oversees our annual enterprise risk management assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats. The Audit Committee oversees our ongoing cybersecurity risk management efforts and regularly receives detailed reports from representatives of our Information Technology Security Team addressing a wide range of related topics. At least annually, our IT leadership (and external cybersecurity experts if applicable) reviews key cybersecurity strategies and policies with the full Board of Trustees, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends and other areas of importance.

companyName: EQUITY RESIDENTIAL

ticker: EQR


text: We have a multi-layered information security governance framework in place to provide oversight of our information security program and strategy, our ISMS, and related risks and opportunities. This governance framework includes procedures for escalation of identified information security risks, threats or incidents through various management levels, including up to our Information Security Governing Body, which is comprised of our Chief Executive Officer, Chief Information Officer, Chief Operating Officer, Chief Financial Officer, Chief Legal Officer and other members of management, and as appropriate, up to our board of directors.

companyName: Alkermes plc.

ticker: ALKS


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, red team exercises, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We also engage an external auditor to conduct an annual payment card industry data security standard review of our security controls protecting payment information, as well as third-party penetration testing of our cardholder environment and related systems. The results of these assessments are reported to the Audit Committee.

companyName: NETFLIX INC

ticker: NFLX


text: We have implemented various processes designed to identify, assess and manage material risks from cybersecurity threats to our information networks, third-party hosted services, communications systems, hardware and software (collectively, our "Systems"), and our data and our clients' data (together, "Data").

companyName: INTELLINETICS, INC.

ticker: INLX


text: Our information security organization is committed to maintaining a robust and resilient security posture that enables us to protect our assets, maintain our stakeholders' trust, and support our business's overall success.

companyName: Hyperscale Data, Inc.

ticker: GPUS


text: The Bank Board is ultimately responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Security Officer and Director of Technology provide reports to the Bank Board, at least annually, regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Bank Board reviews and approves our information security and technology policies annually.

companyName: PEOPLES BANCORP OF NORTH CAROLINA INC

ticker: PEBK


text: We rely on our vendor network to enable the performance of core research and development activities, including clinical trials. As part of our cybersecurity risk management program, we therefore maintain processes to, prior to onboarding and periodically thereafter, assess and review vendor standards around cybersecurity, incident management, and personal data processing, as applicable. Additionally, as appropriate, we include security requirements in vendor contracts.

companyName: Centessa Pharmaceuticals plc

ticker: CNTA


text: Internal Cybersecurity Team The Company's internal information security organization (Internal Cybersecurity Team), led by our Executive Vice President and Chief Information Officer (CIO) as well as the Assistant Vice President and Chief Information Security Officer (CISO), is responsible for coordinating all aspects of the Company's electronic information security systems, including prevention, detection, mitigation, and remediation of cybersecurity incidents, as well as implementing, monitoring, and maintaining our enterprise-wide security strategy, standards, architecture, policies, and processes. Our CIO reports directly to our Chief Executive Officer, our CISO reports to our CIO, and reporting to our CISO are our Deputy Chief Information Security Officer (Deputy CISO) and other experienced information security personnel responsible for various parts of our business. In addition to our internal cybersecurity capabilities, we also periodically engage assessors, consultants, auditors, and other third parties to assist with assessing, identifying, and managing cybersecurity risks. When the Company learns of a cybersecurity incident at a third -party service provider, the Company's respective department contacts maintain communication with the third -party service provider and communicate any cybersecurity incidents to the CISO.

companyName: UNION PACIFIC CORP

ticker: UNP


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and the data of our partners ("Information Systems and Data").

companyName: Cytek Biosciences, Inc.

ticker: CTKB


text: Additionally, the Corporation conducts due diligence in the selection and on-going monitoring of third-party service providers. Management is responsible for ensuring that such third parties use suitable information security controls when providing services to us. As part of the oversight of third-party service providers, management will determine whether cybersecurity risks are identified, measured, mitigated, monitored, and reported by such third parties.

companyName: C & F FINANCIAL CORP

ticker: CFFI


text: The CISO holds undergraduate and masters' degrees in computer science and cybersecurity, respectively, and has served in various senior roles in information technology and information security for over 20 years, including previously serving as the Chief Information Security Officer of a major global asset manager. The CISO has attained the professional certification of Certified Information System Security Professional (CISSP), Certified Information Security Manager (CISM) and Certified in Risk and Information Systems Control (CRISC). The CIO holds undergraduate and masters' degrees in computer science and has served in various roles in information technology for over 30 years. The Company's CRO holds an undergraduate degree and has over 30 years of experience managing risks, including risks arising from cybersecurity threats.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: Risk Management and Strategy the oversight of the Board of Directors since we do not currently have an Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. In support of this approach, our IT security team implements processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident. We also have a process to require corporate employees to undertake cybersecurity training and compliance programs annually.

companyName: Mag Mile Capital, Inc.

ticker: MMCP


text: We maintain a comprehensive process for assessing, identifying, and managing material risks from cybersecurity threats as part of our overall risk management system and processes, including risks relating to disruption of business operations or financial reporting systems, intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputation risk.

companyName: International Seaways, Inc.

ticker: INSW


text: In the 2024 fourth quarter, we reached final resolutions with the FTC and the AG Offices in relation to the Data Security Incident. The resolutions with the FTC and the AG Offices include various ongoing requirements relating to our data privacy and information security programs.

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: Vendor risk management: As part of our risk management program, our vendor risk management teams are responsible for conducting due diligence on vendors submitted for risk evaluation where medium- or high-risk data is in scope. We require assessments of these third-party vendors prior to establishing a business relationship, and annually thereafter for high-risk vendors, as part of our efforts to require these vendors to maintain their commitments related to data security, availability and confidentiality. Our security team's assessment of vendors' security controls and processes is calibrated to the risk level assigned to the vendor.

companyName: HUBSPOT INC

ticker: HUBS


text: We have established a Computer Security Incident Response Team ("CSIRT") that identifies security incidents, characterizes the nature and severity of incidents, and provides diagnostic and corrective actions when appropriate. The security measures the CSIRT employs are consistent with relevant requirements of the National Institute of Standards and Technology ("NIST"), Federal Risk and Authorization Management Program ("FedRAMP"), International Organization for Standardization ("ISO"), and Federal Information Security Management Act ("FISMA"). We have also adopted certain guidelines from NIST and the United States Computer Emergency Readiness Team.

companyName: QUALYS, INC.

ticker: QLYS


text: Information Security Risk Management and Strategy Our Board is responsible for monitoring the Company's key risks and overseeing the risk management structure and programs implemented by management. At meetings throughout the year, the Board receives updates from business unit and functional leaders regarding significant risks and challenges within their areas of responsibility and associated mitigation plans and strategies. The Chief Financial and Administrative Officer is responsible for the Company's enterprise risk management (ERM) system, which helps ensure enterprise risks are being effectively managed. Our ERM processes systematically identify, assess, mitigate and monitor enterprise risks, whether strategic, financial, non-financial, operational, compliance or reporting.

companyName: WHIRLPOOL CORP /DE/

ticker: WHR


text: Our Nomination and Corporate Governance Committee has specific oversight responsibility for cybersecurity The Nomination and Corporate Governance Committee reviews and discusses with management our policies, practices and risks related to information security and cybersecurity.

companyName: GALECTIN THERAPEUTICS INC

ticker: GALT


text: To safeguard our systems, we regularly install and update anti-malware and endpoint detection and response software across all IT-managed systems and workstations. These measures help detect and prevent malicious code from compromising our infrastructure.

companyName: Marvell Technology, Inc.

ticker: MRVL


text: For a discussion of potential cybersecurity risks affecting us, please refer to the "Risk Factors" section of our Registration Statement on Form S-1 filed with the Securities and Exchange Commission on January 22, 2024 titled " Cybersecurity risks could adversely affect our business and disrupt our operations."

companyName: 60 DEGREES PHARMACEUTICALS, INC.

ticker: SXTP


text: The Company is not aware of any cybersecurity threats or incidents to date that have materially affected its strategy, results of operations, or financial condition.

companyName: Dolphin Entertainment, Inc.

ticker: DLPN


text: As part of our overall risk management system and processes, we assess, identify and manage material risks from cybersecurity threats through our Enterprise Risk Management (ERM) program. For a description of cybersecurity risks relevant to our business, see Item 1A, "Risk Factors."

companyName: PHINIA INC.

ticker: PHIN


text: A flat network infrastructure powered by Ubiquiti (UBNT) equipment Unified firewall and security management through our UDM Pro device Remote access controlled via L2TP VPN with pre-shared key authentication Regular data backups using RoboCopy, scheduled daily at 2pm EST Physical security through UniFi Access control system and ADT security cameras covering the entire building We utilize third-party services for certain technology functions, including Microsoft 365 for email, GoDaddy for web hosting, and CodeTwo for email signatures. While we depend on the digital technologies of these third parties, we monitor our systems to protect against unauthorized access.

companyName: OZOP ENERGY SOLUTIONS, INC.

ticker: OZSC


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable regulatory requirements and industry standards.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: The Company's information technology systems, as well as those of the Company's third-party service providers, are subject to cybersecurity threats. Significant cybersecurity threats, including intrusions into, compromises of, or disruptions in the information technology systems of the Company or its third-party service providers could adversely affect the Company's financial condition and results of operations. The Company maintains and updates its information technology systems to mitigate the risk of cybersecurity threats.

companyName: Quanex Building Products CORP

ticker: NX


text: When the Company experiences a cybersecurity incident, the Director of Technology will inform the Cybersecurity Committee, which will then evaluate and assess the materiality of the incident to the Company, its information technology infrastructure and data integrity, and, in particular, whether the cybersecurity incident should be reported to the Board of Directors in advance of or external to the next regular cybersecurity update. Once a cybersecurity incident is reported to the Board of Directors, the Board of Directors provides oversight of the Company's response to such incident. The Cybersecurity Committee continuously monitors incidents as they are remedied to ensure proper remediation and, if necessary, the ability to report to the Board of Directors if previously unknown material information arises during such remediation.

companyName: SEACOR Marine Holdings Inc.

ticker: SMHI


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by IT Management as part of its responsibility for enterprise-wide cybersecurity strategy, policies, implementing Blue Owl's monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes and various other technological and administrative safeguards The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.

companyName: Blue Owl Capital Corp

ticker: OBDC


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of business. The Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable; however, potential vulnerabilities to known or unknown threats will still remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject the Company to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. For more information, see the section titled "Risk Factor— Our business and operations would suffer in the event of computer system failures, including but not limited to our information technology systems, infrastructure and data, or those of our third-party vendors, contractors or consultants failing, becoming unavailable, or suffering security breaches, losses or leakages of data and other disruptions, which could result in disruption of our services, compromise sensitive information (including personal information) related to our business, or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."

companyName: AEON Biopharma, Inc.

ticker: AEON


text: The cybersecurity team reports to our Chief Accounting Officer, which in turn reports to our Chief Financial Officer. Both officers regularly attend audit committee meetings where cybersecurity is discussed and the audit committee is updated on security risks and key initiatives at least twice per year by the senior management team. The TSC is responsible for providing cybersecurity risk management oversight and approving the budget to fund our IT and cybersecurity programs. An important purpose of these management updates is to inform the audit committee of any potential risks and remediation tactics related to our cybersecurity posture, IT systems, and data privacy.

companyName: Silk Road Medical Inc


text: Oversight of Third-party Risk We are aware of the cybersecurity risks associated with engaging third-party service providers. To mitigate such risks, we conduct security assessments of high-risk third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments by our CISO and ongoing assessments by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties.

companyName: ENTEGRIS INC

ticker: ENTG


text: We also assess the risks from cybersecurity threats of our suppliers and third-party service providers. We also require our suppliers and third-party service providers to adopt security-control principles based on NIST or similar global standards.

companyName: MARAVAI LIFESCIENCES HOLDINGS, INC.

ticker: MRVI


text: To operate its business, the Partnership engages certain third-party vendors to perform a variety of functions. The Partnership seeks to engage reliable, reputable service providers. Depending upon the nature of the services and the sensitivity of the data that a third-party service provider processes, the Partnership's vendor management procedures include reviewing the cybersecurity procedures, imposing contractual requirements, and conducting as needed periodic reassessments. The Partnership seeks to further enhance this review to expand the scope and depth of this analysis.

companyName: NEW ENGLAND REALTY ASSOCIATES LIMITED PARTNERSHIP

ticker: NEN


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For further discussion of the risks associated with cybersecurity incidents, as well as a description of an event that occurred in March 2023, see “Risk Factors—Risks Related to Our Business—Security breaches, loss of data, and other disruptions could compromise sensitive business or patient information, cause a loss of confidential patient data, employee data, personal information, or prevent access to critical information, and expose us to liability, litigation, and federal and state governmental inquiries and damage our reputation and brand.”

companyName: BrightSpring Health Services, Inc.

ticker: BTSG


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the NIST, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls; • conduct cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: NexImmune, Inc.

ticker: NEXI


text: We regularly utilize information technology and data to operate our business. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, software, and hardware. Our critical data includes confidential, personal, and proprietary data (collectively "Information Assets"). The Company's risk management program is designed to manage identified material risks, which would include material cybersecurity risks. We rely on a team of internal and external resources, including external information technology and information security vendors to assess how identified cybersecurity threats could impact our business. These assessments may leverage, among other processes, industry tools and metrics designed to assist in the assessment of risks from such cybersecurity threats.

companyName: GTJ REIT, INC.


text: As a large financial technology provider, we continually face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us and our business strategy, results of operations, or financial condition. Despite our efforts to identify and respond to cybersecurity threats, we cannot ensure that we will not experience material cybersecurity incidents in the future or that we have not experienced an undetected incident. For a full discussion of cybersecurity risks, see the section entitled "Risk Factors" in Item 1A.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: For additional information concerning risks related to cybersecurity, see Item lA. Risk Factors: We are increasingly dependent on information technology, and our systems and infrastructure face certain risks, including cybersecurity and data leakage risks.

companyName: Virpax Pharmaceuticals, Inc.

ticker: VRPX


text: We have also established an incident response plan to assess, identify and manage specific potential cybersecurity incidents. This plan requires the corporate security team to notify a response team. The response team assesses the risks of the identified potential incident and determines an appropriate response based on the risks identified. The response team then reports on the incident to senior management and, if necessary, a subset of our financial disclosure committee to determine if the cybersecurity incident should be reported in our public filings.

companyName: National CineMedia, Inc.

ticker: NCMI


text: The ERC and Board Risk Oversight Committee work together to facilitate effective risk management and timely escalation of substantive issues, including Operational Risk (which includes information technology and cybersecurity).

companyName: Independent Bank Group, Inc.


text: Cybersecurity Risk Management and Strategy AerSale has developed and implemented a comprehensive cybersecurity risk management program for identifying, assessing, and managing material risks to protect the confidentiality, integrity and availability of critical systems and information relevant to our business. Our program utilizes a risk-based approach and is designed based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS"), and shares common methodologies, reporting channels, and governance processes that apply across all areas of our enterprise risk management, including legal, compliance, operational, and financial risks.

companyName: AerSale Corp

ticker: ASLE


text: As a provider of cybersecurity solutions, we are passionate about cybersecurity risk management. At CrowdStrike, cybersecurity risk management is an integral part of our overall enterprise risk management program.

companyName: CrowdStrike Holdings, Inc.

ticker: CRWD


text: Management's Role and Expertise in Assessing and Managing Cybersecurity Our Cybersecurity and Information Technology organization is led by our CIO, who is responsible for cybersecurity risk management, with oversight by the Cybersecurity Committee of the board of directors. Our CIO has more than 25 years of experience in the IT industry. Since 2008, he has held senior-level and CIO positions for several companies, each of which included responsibilities or influence for cybersecurity implementation delivery and oversight.

companyName: HUNTINGTON INGALLS INDUSTRIES, INC.

ticker: HII


text: We have an IRP to prepare for and respond to cybersecurity incidents. The process is tested in annual tabletop exercises to help identify strengths and areas for improvement.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: The Audit Committee of our Board of Directors is responsible for overseeing cybersecurity risk management. For each Audit Committee meeting, the Director of Information Technology prepares an updated cybersecurity dashboard, featuring key metrics such as threat detection rates and response times. Additionally, the Director of Information Technology provides an annual cybersecurity briefing to the Audit Committee. External penetration tests and process audits, conducted at regular intervals, are reported directly to the Audit Committee by our third-party firm. These comprehensive measures help to ensure that the Committee remains well-informed and proactive in their oversight of cybersecurity risks.

companyName: Rayonier, L.P.


text: We manage our cybersecurity risks through an information security management system (ISMS) that falls under our overarching integrated management system (IMS) for quality and safety. Our cybersecurity risk management program and supporting ISMS focus our efforts on reducing residual risks to our critical corporate assets. The materiality of these risks drives the selection of appropriate controls and the prioritization of the projects and operational tasks of our cybersecurity teams.

companyName: Fluence Energy, Inc.

ticker: FLNC


text: Our Board is actively involved in the assessment, oversight and management of the material risks that could affect the Company. The Board carries out its risk oversight and management responsibilities by monitoring risk directly as a full Board and, where appropriate, through its committees. The Board has delegated to the Governance, Risk and Nominating Committee the ultimate oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Our cybersecurity and data privacy professionals regularly discuss cyber risks and trends and, should they arise, any material incidents with management and the Governance, Risk and Nominating Committee. Material Risks from Cybersecurity Threats.

companyName: USANA HEALTH SCIENCES INC

ticker: USNA


text: We complete regular cybersecurity assessments to identify potential vulnerabilities and threats, analyzing our infrastructure, systems, and data. Assessments are conducted both internally and by third parties and consider internal and external factors, technological changes, regulatory requirements, and emerging cyber threats. Our cybersecurity program adheres to widely recognized standards for managing cybersecurity risk, including the National Institute of Standards and Technology Cybersecurity Framework, Center for Internet Security Controls and U.K. Cyber Essentials.

companyName: LITHIA MOTORS INC

ticker: LAD


text: We periodically engage with assessors, consultants, auditors, and other third parties to review and improve our cybersecurity program. Compliance with regulatory requirements involves regular third-party assessments. Our processes are also designed to address cybersecurity risks associated with third-party service providers, including risk assessment and due diligence during selection and oversight. Key third parties undergo regular assessments to gauge cybersecurity control effectiveness, with heightened review of those with access to non-public data.

companyName: FEDEX CORP

ticker: FDX


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances, including work with the company's incident response team to help the company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the company's incident response processes include reporting to the Audit committee of the board of directors for certain cybersecurity incidents.

companyName: NEUROCRINE BIOSCIENCES INC

ticker: NBIX


text: The Company does not have its own cybersecurity policy but relies on the policies and procedures of its Contract Research Organizations (CROs) and Software as a Service (SaaS) contractors that handle its data and software. We are committed to protecting the confidentiality, integrity, and availability of our information assets and complying with applicable laws and regulations regarding cybersecurity.

companyName: Mitesco, Inc.

ticker: MITI


text: Ball's Chief Information Security Director (CISD) reports to the Senior Vice President and Chief Information Officer (CIO) and leads the company's cybersecurity team. The CISD is responsible for overseeing cybersecurity, including assessing and managing cybersecurity risk, and together with the CIO, providing comprehensive briefings to the executive leadership team with respect to the cybersecurity program and emerging or potential cybersecurity risks. The cybersecurity team has extensive experience selecting, deploying, and operating cybersecurity technologies, strategies and processes, and couples this knowledge with the use of external experts to protect the company from cyber threats. In the event of a cyber incident, our cross-functional response team will enact our incident response plan, and notify appropriate levels of management, including the executive leadership team, disclosure committee, and Board of Directors, as appropriate.

companyName: BALL Corp

ticker: BALL


text: Regular Evaluation of Initiatives, Results and Priorities The ITSS team, in consultation with members of senior management, updates its strategy at least annually to account for changes in our business strategy, legal and regulatory developments across our geographic footprint, results of recent ITSS initiatives, and developments in the cybersecurity threat landscape. On an annual basis the CISO updates the Audit Committee (generally with all other Board members in attendance) on the performance of cyber risk key performance indicators (KPIs), cyber risks, staffing and key ITSS initiatives. On a quarterly basis the CISO updates the Audit Committee (generally with all other Board members in attendance) on the KPIs and any changes to our cyber risk mitigation efforts, and any cyber breaches that may have occurred. Feedback from the Audit Committee and senior management assists us in determining whether any further changes to our existing policies and practices are warranted. We expect that our cybersecurity risk management processes and strategy will continue to adapt as the cybersecurity threat landscape evolves. We engage third parties to assist us with our cybersecurity risk management and strategy. Some of these third parties provide us with ongoing assistance (such as threat monitoring, mitigation strategies, updates on emerging trends and developments and policy guidance) while others provide targeted assistance (such as security and forensic expertise) as needed.

companyName: MICROCHIP TECHNOLOGY INC

ticker: MCHP


text: Information Technology/Security Committee. The Information Technology/Security Committee ("ITSC") is a management level committee that serves at the direction of the Board and provides oversight of the Company's information technology and information security programs. The members of the ITSC include management and leaders with an expansive background in information technology and cybersecurity. The ITSC meets monthly to review information security and information technology reports and issues. It reports meeting minutes to the Board and ensures the Board has the proper information to adequately assess the risks facing the Company by maintaining oversight of: • effective strategic information technology and information security planning and performance; • major projects, priorities, and overall performance; • the adequacy and allocation of resources; and • the risks involved with the information technology and information security functions.

companyName: HOME BANCSHARES INC

ticker: HOMB


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices follow recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with the specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our patients, collaborators, health care providers, and prospective and future customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: Crinetics Pharmaceuticals, Inc.

ticker: CRNX


text: Aytu adheres to the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0, which provides a set of standards, guidelines and best practices to manage cybersecurity-related risks. We have developed and documented our systems disaster recovery plan, which outlines the roles, responsibilities and procedures for restoring our critical systems and data in the event of a cyber incident. We have also crafted internal policies to help maintain a secure environment, such as our information security policy, our data classification policy, our incident response policy and our password policy. We regularly conduct phishing simulations, vulnerability scans and audits to test the effectiveness of our controls and backups, and to identify and remediate any gaps or weaknesses in our cybersecurity posture.

companyName: AYTU BIOPHARMA, INC

ticker: AYTU


text: Microsoft plays a central role in the world's digital ecosystem. We have made it the top corporate priority to protect the computing environment used by our customers and employees and to support the resiliency of our cloud infrastructure and services, products, devices, and our internal corporate resources from determined adversaries. In response to the evolving cybersecurity threat landscape, we launched the Secure Future Initiative ("SFI") in November 2023 and expanded the scope of SFI in May 2024. The SFI focuses our business strategy and efforts on continual improvement in cybersecurity protection, and is aligned around three security principles: • Secure by Design: Security comes first when designing any product or service. • Secure by Default: Security protections are enabled and enforced by default, require no extra effort, and are not optional. • Secure Operations: Security controls and monitoring will continuously be improved to meet current and future threats.

companyName: MICROSOFT CORP

ticker: MSFT


text: As part of the above approach and processes, we regularly engage with assessors, consultants and other third-parties to review various parts of our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.

companyName: DURECT CORP


text: To date of this Annual Report on Form 10-K, to the actual knowledge of the executive officers of the Company, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business and reputation, as further described in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.

companyName: SURMODICS INC

ticker: SRDX


text: In addition, we maintain specific policies and practices governing our third-party security risks, including our third-party assessment process. Under this assessment process, we gather information from certain third parties who contract with us and share or receive data, to help us assess potential risks associated with their security controls. We also generally require third parties to, among other things, maintain security controls to protect our confidential information and data, and notify us of material data breaches that may impact our data. We assess the risks from cybersecurity threats that impact select third-party service providers with whom we share personal identifying and confidential information. We continue to evolve our oversight processes to mature how we identify and manage cybersecurity risks associated with the services we procure from such third parties.

companyName: Shoals Technologies Group, Inc.

ticker: SHLS