text: The Company has a Cybersecurity Incident Response Plan ("the Plan"), integrated into our enterprise crisis management and business continuity program, which provides protocols and procedures for evaluating and responding to material cybersecurity incidents, including incident handling, disclosure and reporting, notification to senior management, the Board and relevant committees, and meeting external reporting obligations. As part of the Plan, the Company has also established an Incident Response Governance Team, co-chaired by our CISO and VP, Deputy General Counsel, which is a cross-functional group comprised of relevant stakeholders throughout the organization responsible for organizing the assessment, investigation and response to any material cybersecurity event.

companyName: CASEYS GENERAL STORES INC

ticker: CASY


text: Risk Identification: We proactively identify potential threats across our facilities, vendors, operations, systems, and broader IT environment. Threat intelligence, current attack trends, and industry-specific threats inform our risk assessments. Risk Evaluation: We conduct regular risk assessments to measure our preparedness against identified threats. Actionable Plans: We ensure risk is addressed and tracking any necessary remediation through an action plan.

companyName: TurnOnGreen, Inc.

ticker: TOGI

secItem: Item 1C


text: We monitor cybersecurity threats across our systems through both automated tools and manual review processes. Ma nagement is responsible for the overall implementation and effectiveness of our cybersecurity program. This includes allocating resources, establishing policies, and ensuring employee adherence to security practices. The Company's Vice President of Operations manages our cyber security process and reports to our President and Chief Operating Officer and our Chief Executive Officer who reports to the Company's Board of Directors.

companyName: Verses AI Inc.

ticker: VRSSF


text: Our management team, including our CISO, Chief Operating Officer (COO), Chief Financial Officer (CFO), Chief Technology Officer (CTO) and General Counsel (GC), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes knowledge related to cybersecurity and incident response, risk management, control analysis and corporate governance. Specifically, our CISO has over 23 years of cybersecurity experience and an advanced degree in information security and our information security team members have relevant cyber certifications and are trained in our key security solutions.

companyName: AUDACY, INC.


text: Cross-Functional Collaboration and Coordination. Our information technology ("IT") security operations and risk management team ("IT Security Team"), led by our Chief Information Security Officer ("CISO"), has first line responsibility for the implementation and operation of our cybersecurity risk management processes. However, this team works together with other internal teams to coordinate efforts, priorities and oversight. These include: our IT Risk Council (the "Council"), which is comprised of key leaders from stakeholder groups throughout the Company and led by our CISO and meets monthly to review metrics and discuss risks and recent events;

companyName: EASTMAN KODAK CO

ticker: KODK


text: The Company's management team is responsible for the day-to-day management of cybersecurity risks we face and oversees the Information Technology Steering Committee. The Information Technology Steering Committee manages the oversight of the information security assessment, development of policies, standards and procedures, testing, training and security report processes for the Company. The Information Technology Steering Committee is comprised of officers with the appropriate expertise and authority to oversee the Information Security Program.

companyName: SECURITY FEDERAL CORP

ticker: SFDL


text: Commencing in 2024, our Audit and Risk Committee is taking the lead on behalf of the board of directors on oversight of our cybersecurity risk management program.

companyName: BOSTON OMAHA Corp

ticker: BOC


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For more information, see "Item 1A. Risk Factors, Our operations have been and will continue to be subject to cyber-attacks that could have a material adverse impact on our business, consolidated results of operations, and consolidated financial condition ".

companyName: MINERALS TECHNOLOGIES INC

ticker: MTX


text: As discussed further under the heading "Cybersecurity Governance," the AGM Board of Directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer (" CISO

companyName: Apollo Infrastructure Co LLC


text: The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to proactively address cybersecurity threats and prevent incursions, and to communicate the Company's evolving information security policies, standards, processes, and practices. Our awareness program includes assessment of our personnel's preparedness through regular phishing e-mail alerts, highlighted banners that warn about external senders, and tests administered to help the Company's personnel interrogate, navigate around, and avoid clicking suspicious and unfamiliar links from unknown senders.

companyName: EASTERN CO

ticker: EML


text: Our CISO is primarily responsible for assessing, monitoring and managing cybersecurity risks, including those presented by third-party service providers, as well as overseeing employee training programs. Our CISO has served in this role since July 2019, has a Master's Degree in Information Security from the University of London, has been working in technology risk management since the early 1990s, holds Certified Information Systems Security Professional status and is a member in good standing of the Institute of Electrical and Electronics Engineers ("IEEE") and the International Information System Security Certification Consortium ("ISC2"). The CISO reports at least annually to the Board of Directors on material cyber risks, including those identified in our business and rising threats, and the current state of L&W's information security and will continue to do so on a regular basis as needed.

companyName: Light & Wonder, Inc.

ticker: LAWIL


text: Information security risk is managed as an operational risk under the non-financial risk management framework of Deutsche Bank Group. The Chief Security Office, in its responsibility as the first line of defense, executes against the non-financial risk management framework and leverages its various instruments whereas the non-financial risk management as the second line of defense provides oversight, review, and challenge. Accordingly, part of the non-financial risk committee's remit is to oversee and govern Deutsche Bank Group's cybersecurity risk profile, remediation programs and risk tolerance. Should a cybersecurity incident occur, Deutsche Bank Group has an established protocol for communicating such incident to the divisions of Deutsche Bank Group that may be impacted, including chief security officers and division heads. Those personnel in turn will notify potentially affected groups further downstream as applicable, including down to us if any our or our stockholders' information may be at risk.

companyName: RREEF Property Trust, Inc.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology environment and customer-facing products.

companyName: LIQTECH INTERNATIONAL INC

ticker: LIQT


text: Occidental has implemented and maintains a cybersecurity incident response plan that provides the organizational and operational protocol for the Company to effectively and timely respond to cybersecurity incidents. In the event of a material cybersecurity incident, Occidental's CIO will receive regular updates and monitor detection, mitigation and remediation through reports from a team of experienced cybersecurity leaders responsible for actioning the Company's cybersecurity incident response plan. As a material cybersecurity incident is handled by the team, the CIO will maintain communication and information flow to senior leadership as well as the Audit Committee and/or the Board, as appropriate.

companyName: OCCIDENTAL PETROLEUM CORP /DE/

ticker: OXYWS


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) the Cybersecurity Risk Management Team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our Senior Vice President and General Counsel, our Chief Financial Officer and our Vice President, Finance and Controller evaluate material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.

companyName: Regulus Therapeutics Inc.


text: The Audit Committee receives annual reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Lite Strategy, Inc.

ticker: LITS


text: Insurance and Risk Mitigation We maintain cybersecurity insurance to mitigate the financial impact of potential incidents. However, we recognize that insurance is only one component of a multifaceted risk management strategy. Incident Response and Risk Management at QHSLab, Inc.

companyName: QHSLab, Inc.

ticker: USAQ


text: The use of these third-party providers is regularly reviewed and monitored by the appropriate members of management. We conduct thorough assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards.

companyName: Planet 13 Holdings Inc.

ticker: PLNH


text: As part of our IRP, we conduct regular testing to ensure that the IRP is functional and effective. Tests may include tabletop exercises, full simulations, verbal walkthroughs with relevant stakeholders, or responses to actual Security Incidents.

companyName: ContextLogic Inc.


text: A key part of our strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, and other exercises focused on evaluating effectiveness. We periodically engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness. The results of such assessments and reviews are reported to the Board, the Audit Committee, and the Technology and Cybersecurity Committee, and we make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.

companyName: BLACKLINE, INC.

ticker: BL


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. See Item 1A. Risk Factors, "Cyber security threats or other security breaches, or any other impairment of the confidentiality, integrity or availability of our IT systems, or those of one or more of our corporate infrastructure vendors, could have a material adverse effect on our business" in this Annual Report on Form 10-K for additional information about our cybersecurity-related risks.

companyName: Broadcom Inc.

ticker: AVGO


text: Our cybersecurity program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, programs, and our broader enterprise information technology environment; • a security program is in place for managing (i) our cybersecurity risk assessment processes, (ii) implementation and oversight of our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, implement and manage, or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for assessing and responding to cybersecurity incidents; • ad hoc internal review of the cybersecurity practices of key service providers based on our assessment of their criticality to our operations and respective risk profile; and • an Information Security risk management program that includes the risks within legal, quality, human resources, communications, clinical operations and financial teams pertaining to information security.

companyName: Metsera, Inc.


text: Cybersecurity Risks. We have not experienced any material cybersecurity incidents in the past fiscal year. We face risks from cybersecurity threats that, if realized, may materially affect our business strategy, results of operations or financial condition. Despite our efforts, our cybersecurity risk management processes may not be fully implemented, complied with or effective in preventing or mitigating future cybersecurity risks. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or, if realized, are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in Part I, Item 1A. "Risk Factors."

companyName: HOME DEPOT, INC.

ticker: HD


text: The CCO and Crescent also review key Company service providers' compliance and risk management policies and procedures related to cybersecurity matters, evaluate such service providers' use of information systems which have the potential to subject the Company to information technology vulnerabilities and receives reports from the Company's service providers regarding any cybersecurity threats and incidents. As part of the oversight of the Company's key service providers, Crescent engages a third-party consultant to conduct a cybersecurity assessment and preparedness analysis on such service providers on an annual basis. The CCO and the Head of Information Technology provide regular reports to the Board regarding significant risks to the Company, including, among others, those relating to cybersecurity. In addition, the CCO informs the Board regarding material cybersecurity matters as they arise. The Company has also adopted policies and procedures designed to ensure the timely disclosure of any material cybersecurity incidents.

companyName: Crescent Private Credit Income Corp


text: Following these risk assessments, we evaluate whether, and if so, how, to design, implement, and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer (our "CISO"), who reports to our Chief Information Officer, to manage the cybersecurity-related risk assessment and mitigation process.

companyName: Samsara Inc.

ticker: IOT


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: Apple iSports Group, Inc.

ticker: AAPI


text: To date, the Company does not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations, or financial condition. As discussed more fully under "Item 1A—Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions the Company takes to reduce the risk of cyber incidents and protect its systems and information may be insufficient. No matter how well designed or implemented the Company's cybersecurity controls are, it will not be able to anticipate all security breaches, and it may not be able to implement effective preventive measures against cybersecurity breaches in a timely manner. See "Item 1A—Risk Factors—If we experience difficulties with technology, data and network security (including as a result of cyber attacks), outsourcing relationships or cloud-based technology, our ability to conduct our business could be negatively impacted."

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: Our Board, through the Audit Committee, oversees our cybersecurity risk management process. Our Audit Committee receives regular presentations and reports on cybersecurity risks at Ellington, each of which addresses a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Ellington employs internal or external resources whose responsibilities include oversight of their respective firm's cybersecurity posture.

companyName: Ellington Credit Co

ticker: EARN


text: Our Adviser's information security program is led by its Chief Information Security Officer ("CISO") who reports directly to the GCSO and has extensive experience in specializing in information security and risk management. Our Adviser's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity, and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets.

companyName: Invesco Commercial Real Estate Finance Trust, Inc.


text: Cybersecurity tools and services are configured to identify threats and risks that may be associated with the use of third-party applications or solutions.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information from cybersecurity threats. Cadiz Inc.

companyName: CADIZ INC

ticker: CDZI


text: The company maintain a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. Keep in mind we are a small company with limited exposures. As such we rely on traditional bookkeeping and reconciliations to discover any cybersecurity issues.

companyName: AXIM BIOTECHNOLOGIES, INC.

ticker: AXIM


text: Our board of directors oversees our risk management strategy with respect to cybersecurity risks and threats. The board, through its audit committee, holds regular meetings quarterly to discuss issues including our cybersecurity threats, and has a dedicated agenda during such meetings that are designed to assist the audit committee to exercise its oversight function. The meetings involve presentations and reports from the Chief Information Security Officer and management, including updates on contemporary cybersecurity threats faced by us and steps we are taking to address them.

companyName: Cardlytics, Inc.

ticker: CDLX


text: The Chief Information Security Officer (CISO) is the management position with primary responsibility for the development, operation, and maintenance of our information security program. The Company's CISO has cybersecurity experience that includes being a lead auditor for ISO/IEC 27001 with knowledge of both operations and governance. In his previous position as Chief Technology Officer for an international managed security service provider, he worked as Virtual CISO, Incident manager and security auditor for several multinational companies. We have established a Cybersecurity Steering Committee to provide management level oversight of cybersecurity. The Cybersecurity Steering Committee reviews the annual risk assessment and provides comments on the overall information security program. Oversight of the information security program at the Board level sits with the Audit Committee. The CISO provides quarterly updates on the information security program to the Audit Committee and more frequently as circumstances require.

companyName: GUESS INC

ticker: GES


text: Breeze currently does not have significant operations. The Company is focused on effecting an initial business combination with one or more businesses. Upon completion of the pending Business Combination with TV Ammo, Breeze will face risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. Breeze acknowledges that the risk of a cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. No prior cybersecurity incidents have been identified by the Company. The Company proactively seeks to detect and investigate unauthorized attempts and attacks against Company IT assets and data, and to prevent their occurrence and recurrence where practicable, however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm.

companyName: Breeze Holdings Acquisition Corp.


text: A. Board of Directors' Oversight of Risks from Cybersecurity Threats The Company's Board considers cybersecurity risk as critical to the enterprise. The full Board oversees the Company's Enterprise Risk Management program which incorporates cybersecurity risks together with other top operational, reporting and compliance risks the Company manages. The full Board is kept apprised by Management of the Company's cybersecurity risk assessment results, and an escalation process exists to inform the Board of high-severity cybersecurity incidents that may occur. In addition, the Board periodically engages independent third-party technology experts to test the Company's information technology systems, including cybersecurity.

companyName: MERCURY GENERAL CORP

ticker: MCY


text: The Board's Role - As a part of its regular risk oversight, Luxfer's Board of Directors is responsible for overseeing cybersecurity, information security, and technology risk. The Board is comprised of independent Non-Executive Directors, and one Executive Director. Luxfer's Senior Leadership team provides regular reports on information security matters at least quarterly to the Board, as it is their responsibility to oversee Management's actions to identify, access, mitigate and remediate material risk.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: Our Information Security Team is outsourced to two separate service providers, one of which oversees all aspects of IT and facilities to ensure the Company's infrastructure, including intellectual property, is protected. Specifically, this service provider is tasked with communicating any issues or updates necessary and possesses the appropriate level of expertise to assess and manage the Company's cyber security risk. This service provider reports to our Principal Financial Officer, who oversees prevention, detection, mitigation, and remediation efforts through regular communication and reporting channels within our organization and with service providers.

companyName: International Stem Cell CORP

ticker: ISCO


text: Our cybersecurity program is led by the Senior Manager of our Enterprise IT Security Risk and Compliance team, who reports to the Managing Director of Enterprise IT. The Senior Manager has over 30 years of IT experience, with over 20 years specializing in cybersecurity. He has strategic and operational responsibility for all aspects of the company's cybersecurity program, including how cyber risks are identified and assessed and how the company prepares for, detects, responds, and recovers from cyber threats. Quarterly cybersecurity program updates and as-needed reporting on cybersecurity incidents are provided to the Chief Executive Officer, Chief Financial Officer, and General Counsel.

companyName: TORO CO

ticker: TTC


text: Our VP of IT meets with the audit committee quarterly to review our information technology systems and discuss key cybersecurity risks, and these matters are also presented to the board of directors annually. In addition, our chief financial officer reviews with the audit committee, at least annually, our global enterprise risk management program, which includes cybersecurity risks, and is also reported to the board of directors.

companyName: Adeia Inc.

ticker: ADEA


text: In an effort to prevent and detect cyber threats, the Company provides all employees with cybersecurity prevention training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately.

companyName: LL Flooring Holdings, Inc.


text: Our incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Cybersecurity Risk Management Committee. This group works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Vera Therapeutics, Inc.

ticker: VERA


text: The CISO, who oversees an organization that supports the day-to-day operation of the Program, is qualified in the areas of data protection and cybersecurity and has more than 30 years of experience leading information and physical security operations, with the emphasis on threat and vulnerability management, malware protection and cyber forensics. Prior to joining MetLife in 2024, the CISO was a chief security officer and a cybersecurity leader at other financial institutions, where he oversaw global cybersecurity programs for physical security, executive protection, risk management, critical incident response and management, disaster preparedness, third-party risk, insider threat, and security background investigations. He holds multiple patents for systems and methods related to information security risk assessment, including three information security patents from his prior employment with another large U.S. financial institution.

companyName: METROPOLITAN LIFE INSURANCE CO


text: Policies and Procedures We have implemented cybersecurity policies and standards based on leading industry frameworks, including the ISO 27001 standard and the National Institute of Standards and Technology Cybersecurity Framework, and we regularly assess our policies and practices, including tabletop exercises, aimed at mitigating cybersecurity risks. In the event of a cybersecurity incident, we follow our Enterprise Information Security Incident Response Plan (the "IRP"), which outlines steps from incident detection to assessment, response, mitigation, recovery and notification, including to key functional areas such as Global Risk Management, Corporate Law, Privacy and Compliance, senior leadership and the Board, as appropriate. The IRP includes quantitative and qualitative incident assessment guidance and promotes engagement with multidisciplinary teams across the enterprise to facilitate real-time information-sharing during a cybersecurity incident.

companyName: ASSURANT, INC.

ticker: AIZ


text: The Company devotes significant resources to help protect and evolve the security of its computer systems, software, networks, and other technology assets, and the Company's cybersecurity risk management program includes physical, administrative, and technical safeguards. The Company's cybersecurity policies, standards, and procedures include data breach response plans, which are reviewed regularly. The Company annually assesses its cybersecurity program and safeguards against the National Institute of Standards of Technology Cybersecurity Framework (the "Framework"). The Company's cyber incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes intended to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations.

companyName: CHOICE HOTELS INTERNATIONAL INC /DE

ticker: CHH


text: In addition, the Company conducts frequent security awareness trainings for all associates, utilizes malware, antivirus, and spyware protections and has other protections in place for its network and users. The Company maintains robust end user and administrative user policies governing the use of Company technology. The Company also maintains cyber liability insurance coverage and performs regular vulnerability and penetration assessments.

companyName: EPR PROPERTIES

ticker: EPR


text: While cybersecurity risks have the potential to materially affect our business, financial condition, and results of operations, we do not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected us, including our business strategy, results of operations, or financial condition. For further discussion of risks from cybersecurity threats, see "Item 1A. Risk Factors" in this Report.

companyName: RED RIVER BANCSHARES INC

ticker: RRBI


text: In the event of an incident, meaning a compromise is not contained by our security systems and has the potential to adversely impact the organization, we have a structured Incident Response Plan in place that is based on National Institute of Standards and Technology (NIST) guidelines that provide rules for communicating incidents to management based on defined categorizations of the incident, as well as an orderly process for addressing and documenting the incident. As part of our business continuity and disaster recovery strategy, we have a strong backup and off-site data replication process, including an air-gap data vault solution for replication of backups of critical systems. Restorations from these systems are tested on a quarterly basis.

companyName: Intrepid Potash, Inc.

ticker: IPI


text: Our cybersecurity program includes an incident response plan that includes all relevant and critical members of management and third-party service providers alike.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: Members of the Board and Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: GSI TECHNOLOGY INC

ticker: GSIT


text: GECM has also developed an incident response framework to monitor the prevention, detection, mitigation and remediation of cybersecurity events. This framework is managed and implemented by Great Elm IT Management, with support from their third-party consultants. Great Elm IT Management alongside the General Counsel and Chief Compliance Officer of GECM are responsible for gathering information with respect to cybersecurity incidents, assessing its severity and determining potential responses, as well as communicating with business leaders and senior management, as appropriate.

companyName: Great Elm Capital Corp.

ticker: GECC


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. As part of its enterprise risk management efforts, the Board meets with senior management, including the executive leadership team, to assess and respond to critical business risks. Critical enterprise risks are assessed by senior management annually and discussed with the Board. Once identified, each of the risks we view as most significant is assigned an executive risk owner who is responsible to oversee risk assessment, develop and implement mitigation plans, and provide regular updates to the Board (and/or Board committee assigned to the risk). Cybersecurity threats have been and continue to be identified as one of the Company's top risks, with our Chief Enterprise Technology Officer and Chief Information Security Officer assigned as the executive risk owners. The Board has delegated primary responsibility for the oversight of cybersecurity and information technology risks, and the Company's preparedness for these risks, to the Audit Committee.

companyName: FORD MOTOR CO

ticker: F


text: We have a comprehensive cybersecurity risk assessment program designed to assess, identify, and manage material risks associated with cybersecurity threats and vulnerabilities and to mitigate the potential impact of any cybersecurity incidents on our operations and financial condition. We routinely review, modify, and update this program as necessary to address emerging risks. Our process for addressing risk is based on industry best practices outlined in CIS Critical Security Controls. Although this program is integrated within the Company's overall risk management system, the implementation of this program requires a unique and specialized level of expertise and experience, which has led us to create a cybersecurity team and various processes designed to address these specific risks, as discussed more below.

companyName: NEOGEN CORP

ticker: NEOG


text: We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes and practices. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve and recover from security incidents in a timely manner. We require annual information security training to be completed by our employees, and we maintain a limited cybersecurity liability insurance policy.

companyName: REGENXBIO Inc.

ticker: RGNX


text: The Company's Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. The Audit Committee of the Board of Directors is responsible for board-level oversight of cybersecurity risk, and the Audit Committee regularly reports risks and compliance actions to the Board. As part of its' oversight role, the Audit Committee receives reporting about the Company's strategy, programs, incidents and threats, and other developments and action items related to cybersecurity regularly throughout the year, including through periodic updates from the IT Administrator.

companyName: TREES Corp (Colorado)

ticker: CANN


text: Our Vice President of Operational Engineering is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: We regularly review our cybersecurity defenses to assess our vulnerability to cybersecurity attacks from viruses, malware and more sophisticated and targeted cyber-related attacks such as hackers looking to demand ransomware or access our systems to obtain information and data, as well as our vulnerability to cybersecurity failures resulting from human error and technological errors. We rely upon internal IT personnel working in conjunction with specialized outside security consultants on a day to day basis to conduct reviews and upgrade our systems when determined to be necessary.

companyName: AiXin Life International, Inc.

ticker: AIXN


text: We provide mandatory training for our personnel regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the ISSC, the audit committee, and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. Insurance—We maintain cyber insurance coverage.

companyName: Redfin Corp


text: During the fiscal year ended February 29, 2024, we have not identified any risks from cybersecurity threats that have materially affected our business operations or financial conditions.

companyName: ENNIS, INC.

ticker: EBF


text: Our cybersecurity program is overseen by the Chief Information Officer and Chief Information Security Officer. Both the Chief Information Officer and Chief Information Security Officer have extensive experience in running and managing a cybersecurity program both in civilian and government agencies.

companyName: AMERICAN PUBLIC EDUCATION INC

ticker: APEI


text: As an externally managed company, we rely on the Adviser and its affiliates' information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by TPG. TPG has established an Enterprise Risk Committee ("ERC") to manage overall risk across the organization including cybersecurity risks identified by TPG's cybersecurity team; the ERC includes representatives from relevant functions and is led by TPG's Chief Executive Officer. TPG has also established an Operational Risk Committee ("ORC") which is responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of the Adviser's risk management, control and governance processes is assigned to TPG's Chief Information Security Officer ("CISO"), who periodically reports, among other things, potentially material cybersecurity incidents to the ORC and reports to the ERC at least annually. TPG's cybersecurity team also regularly coordinates with other key stakeholders within the organization, including compliance, human resources, internal audit and legal. The CISO leads TPG's cybersecurity team, which is responsible for implementing, maintaining and enforcing our cybersecurity program. TPG's CISO previously held various leadership roles within the Technology Risk department of one of the world's largest banking institutions over a 17-year period. TPG has informed us that the CISO holds a Bachelor of Science in Electrical Engineering and Mathematics from the University of Texas at Arlington and is a Certified Information Systems Security Professional (CISSP). TPG's cybersecurity team possesses a variety of cybersecurity skill sets and extensive expertise obtained through decades of experience, numerous industry certifications, and advanced degrees. TPG's cybersecurity team continues to take steps to maintain up-to-date knowledge of evolving cybersecurity threats and countermeasures.

companyName: TPG Twin Brook Capital Income Fund


text: Since we understand that cybersecurity threats are complex and evolving, we have a dedicated team of both internal and external cybersecurity experts, which is led by our Chief Information & Cybersecurity Officer ("CICSO"). This team is responsible for publishing information technology and security policies, promoting compliance with those policies, implementing a program to mitigate potential threats, and performing periodic risk and maturity assessments. Our risk mitigation measures include network segmentation, cyber protection and containment, detection and response, and recovery. The primary goal of this team is to decrease the risk of cyber incidents having a material impact.

companyName: TREACE MEDICAL CONCEPTS, INC.

ticker: TMCI


text: Our CISO has served in various roles in information technology and information security for over 20 years, with experience in technology risk management, cybersecurity, compliance, network engineering, information systems, and business resiliency. He is a Certified Information Systems Security Professional. Our CISO manages the Company's information security and oversees our data security personnel and our incident response and business continuity management programs to assess and manage the cybersecurity element of our risk management program, including policies, cybersecurity training, security operations and engineering, cyber threat detection and incident response. Our CISO promptly informs and updates the Board about any information security incidents that may pose a significant risk to the Company.

companyName: VSE CORP

ticker: VSEC


text: The board and the risk committee receive regular presentations and reports from management as well as outside experts on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technology trends and information security considerations arising with respect to our peers and third parties. On an annual basis, the board and the risk committee discuss our approach to cybersecurity risk management with our Chief Risk Officer, Chief Compliance Officer and Chief Information Officer, among others. The board and the risk committee receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: FISERV INC

ticker: FISV


text: The Board of Directors is responsible for the oversight of our cybersecurity risk management program. On a quarterly basis, our Chief Information Officer (CIO) provides a cybersecurity status report and update to the Board of Directors, which includes a scorecard of cybersecurity threats, updates on key initiatives, and any changes in trends that may impact the Company. The CIO reports directly to the President and Chief Executive Officer (CEO) and meets regularly with him, the Chief Financial Officer, and other members of the Executive Leadership Team. The CIO has over 25 years of experience in IT Operations and is supported by an internal Director of IT Security and a virtual Chief Information Security Officer (vCISO) service to ensure comprehensive focus on the program.

companyName: FLEXSTEEL INDUSTRIES INC

ticker: FLXS


text: Our Board of Directors considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees and is regularly updated on management's design, implementation and enforcement of our cybersecurity risk management program. The Audit Committee is composed of board members with varied expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks.

companyName: SIMON PROPERTY GROUP L P


text: We use tools and techniques to continually assess, monitor, manage, and mitigate security risks to our technology systems. Our processes extend to third-party service providers, who have access to data on our systems. We engage a third party to perform an independent assessment of our cybersecurity penetration test and risk assessment program at least once every two years.

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: Further, pursuant to our CIRP, we have engaged third-party support under a retainer agreement to enable an effective and timely response to a significant cybersecurity incident. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. We obtain Systems and Organization Controls ("SOC") 1 and SOC 2 reports, as applicable, from our third-party service providers which assess those entities' controls to cover security, availability, integrity, confidentiality and privacy. Any applicable findings of this third-party assessment are analyzed by the appropriate employees and further action is taken as needed.

companyName: Valaris Ltd

ticker: VAL


text: The Company's CTIO leads the core elements of Ulta Beauty's IT and Digital functions, including IT infrastructure, systems and security, digital experience and operations, and consumer technology. He has served in various roles in information technology and information security for over 30 years, including serving as the Global Chief Technology Officer of a large public company prior to joining the Company. The Vice President IT Risk Management leads our information risk management organization responsible for overseeing the Company's information security program. She has over 25 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies.

companyName: Ulta Beauty, Inc.

ticker: ULTA


text: The Company uses a third-party external auditor to perform annual audits, which include cybersecurity components, and a cybersecurity advisory firm to conduct annual risk assessments and penetration tests.

companyName: Drilling Tools International Corp

ticker: DTI


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' and the IRT are responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Cidara Therapeutics, Inc.


text: We prioritize cybersecurity and data privacy. Our IT department is responsible for coordinating the protection of our information systems and the data they maintain.

companyName: Meritage Homes CORP

ticker: MTH


text: We have implemented a written information security program ("WISP") to create administrative, technical and physical safeguards at KVH for the protection of confidential information of KVH and its employees and customers and other third parties. The WISP sets forth our procedures for evaluating our electronic and physical methods of collecting, storing, accessing, using, transmitting, and protecting confidential information, including personal information, as defined by federal and state law. We have utilized the National Institute of Standards and Technology's Cybersecurity Framework (NIST CSF) as a baseline for the WISP procedures in addition to General Data Protection Regulation (GDPR) standards. In addition to our data privacy policy, the WISP policy defines how sensitive and private data are protected. Under our procedures, we perform an annual risk assessment to identify and prioritize key cybersecurity risks, and we update this assessment when we receive information about material new cybersecurity risks. Once we identify material cybersecurity risks, we seek to identify and implement prevention measures. Current prevention measures include, among other things, to the extent we determine to be appropriate for our information systems in light of our financial, personnel and other resources, restricted physical access, restricted systems access, multi-factor authentication, software solutions such as intrusion detection systems, anti-virus, anti-malware, e-mail filtering and quarantining programs, routine system maintenance and updates, backup and recovery systems, routine employee cybersecurity training and testing, and quarterly internal audits. The measures we take may be inadequate to protect us from cybersecurity risks. See "Item 1A. Risk Factors – Risks related to our dependence on third parties and third-party technology – Cybersecurity breaches could disrupt our operations, expose us to liability, damage our reputation, and require us to incur significant costs or otherwise adversely affect our financial results."

companyName: KVH INDUSTRIES INC \DE\

ticker: KVHI


text: Effective incident response involves every part of our organization, including business operations, finance and outside service providers for key business applications. Our Board of Directors oversees all business, property and affairs of the Company, including cybersecurity risks. Our management keep the members of the Board informed of our business through discussions at Board meetings and by providing them with reports and other materials throughout the year.

companyName: PARKS AMERICA, INC

ticker: PRKA


text: At least annually, we review our security controls and address information security vulnerabilities, conduct security testing, and assess our external sources for their security risk (e.g., security incidents, data security, security controls, third parties, etc.). The results of the assessment are used to drive alignment and prioritization of initiatives to enhance our security posture, improve security processes, and to manage a broader enterprise-level risk program that is presented to the Board of Directors, the Audit Committee, and members of management.

companyName: Red Cat Holdings, Inc.

ticker: RCAT


text: Protecting information, including information of our clients, is a top priority. We have expertise, dedicated resources and technology to identify, assess, respond to and mitigate material risks from cybersecurity threats. Our Global Information Security organization (GIS), led by our Chief Information Security Officer (CISO), establishes and maintains our company-wide information security management program and provides guidance for information security activities and controls at Unisys. Through our GIS, we: • establish and maintain corporate information security policies and procedures for identifying, assessing and addressing cybersecurity events; • track and analyze data as it moves through the information systems; • analyze the overall cybersecurity risk to information and systems (including the physical security and cybersecurity); • remediate known cybersecurity vulnerabilities; and • follow evolving information security regulatory guidance for countries in which we operate and adjust internal policies, processes and remediation actions, as necessary.

companyName: UNISYS CORP

ticker: UIS


text: We have a Head of Global IT whose global information security team (IT Security Team) is responsible for leading organization-wide cybersecurity strategy, policy, standards and processes and works across relevant operating entities to assess and prepare us to address cybersecurity risks. Our Head of Global IT and IT Security Team perform due diligence on the IT security systems and processes of all potential acquisition targets, and newly acquired companies are not permitted access into our IT networks or systems until they have met the necessary security standards. The Head of Global IT's cybersecurity experience includes managing the network, infrastructure security and a cyber security team of a global consumer products company with a heavy online presence and with sales of services and goods to the U.S. government. In addition, our IT Security Team consists of employees that have security certifications from reputable cybersecurity training organizations, including CompTIA, and over 20 years of combined infrastructure architecture experience, including PCI, SOC1 and SOC2 level compliance.

companyName: KADANT INC

ticker: KAI


text: The Bank's business continuity program is designed to ensure that necessary resources are in place to protect the Bank from potential loss during a disruption, which includes the unavailability of information technology assets due to unintentional occurrences like weather-related events, fire, power loss, and technical incidents such as hardware failures. The business continuity program is overseen by the Technology Committee of the Board and includes, among other items, business impact analysis for developing effective plans, including disaster recovery plans, to respond, recover, resume, and restore technology assets critical to the Bank's operations. Elements of this plan may be leveraged in support of recovery from a cyber incident that disables critical infrastructure.

companyName: Federal Home Loan Bank of New York


text: Information Technology and Cybersecurity Risks We have no employees and rely on the Advisor, a wholly-owned subsidiary of Franklin Templeton, to manage our day-to-day operations pursuant to the Advisory Agreement. Therefore, we rely heavily on Franklin Templeton's information systems and their program for defending against and responding to cybersecurity threats and incidents. Franklin Templeton maintains a robust cybersecurity defense program, including a dedicated cybersecurity team led by its Chief Security Officer ("CISO"). The CISO, who reports directly to the Franklin Templeton Executive Vice President, Chief Risk and Transformation Officer, has 28 years of experience in the information technology and cybersecurity field and has been at Franklin Templeton for 12 years. The CISO provides regular briefings for our senior management team on cybersecurity matters, including threats, events, and program enhancements.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: W e use independent third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements and industry guidelines. We also engage with outside risk experts and industry groups, including other peer institutions, as needed, to help us evaluate potential future threats and trends, particularly with respect to emerging information security and fraud risks. We generally have agreements in place with our service providers that include requirements related to cybersecurity and data privacy. We cannot guarantee, however, that such agreements will prevent a cyber incident from impacting our systems or information. Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed to our service providers in relation to any data that we share with them.

companyName: Village Bank & Trust Financial Corp.


text: Because the Company is a bank holding company, its information security program is regularly evaluated by banking examiners and regulators. In addition, the Company undergoes annual Service Organization Controls Type II audits to evaluate information security controls related to specific services offered by the Company.

companyName: CASS INFORMATION SYSTEMS INC

ticker: CASS


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Board of Directors Oversight Our board of directors oversees the management of risks associated with cybersecurity threats.

companyName: Stran & Company, Inc.

ticker: SWAG


text: The Audit Committee assists the Board in fulfilling its fiduciary duties regarding cybersecurity risk oversight. The Audit Committee is composed of directors with diverse professional experience, including three members with backgrounds in cybersecurity. We believe this expertise enables our Audit Committee to effectively oversee our cybersecurity risks and incident response plans. For more information on our directors' expertise, see our definitive proxy statement for our 2024 Annual Meeting of Stockholders to be filed with the SEC.

companyName: QXO BUILDING PRODUCTS, INC.


text: Material Impact of Cybersecurity Risks We have not experienced a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition.

companyName: EXICURE, INC.

ticker: XCUR


text: Our CISO reports to our CIO who is responsible for the development and implementation of our technology, data and information management strategy. Our CIO has over twenty years of experience in technology, data management, data science and analytics, earned a bachelor's degree in mechanical engineering and a master's degree in industrial engineering – operations research. Before joining JLL, our CIO previously held positions as Chief Data Officer, Global Head of Customer Intelligence, Head of Global Analytics and Head of Product Management for a large global financial services institution.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: We are committed to protecting our information systems against cybersecurity threats. Any cybersecurity incident can adversely affect our business and disrupt our operations as described in greater detail in our Risk Factors relevant to cybersecurity risks. Our senior leadership, in consultation with our board of directors, has assigned responsibilities for ensuring and overseeing the operation of our information security program to the Marchex Information Security Committee ("ISC") comprised of senior representatives of departments across our organization.

companyName: MARCHEX INC

ticker: MCHX


text: • Cohen & Steers' CISO oversees the information security group and program within its IT department, has over 25 years of experience, including similar roles at other financial services companies, holds the Certified Information Systems Auditor (CISA) and Certified in Risk and Information Systems Control (CRISC) certifications and is registered with FINRA for the Series 99. • Cohen & Steers' CTO oversees its IT department and has served in various roles in information technology for over 29 years, including senior leadership roles at another financial services company. • Cohen & Steers' Head of IT Infrastructure oversees the infrastructure and service desk within its IT department and has served in various roles in information technology for over 13 years.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: Bone Biologics Corp

ticker: BBLG


text: the use of third -party service to conduct mandatory online training for all employees regarding identifying and avoiding cyber-security risks.

companyName: FUEL TECH, INC.

ticker: FTEK


text: We rely on a multidisciplinary team (including from our information security function, management and third party service providers, as described further below) to assess how cybersecurity threats could impact our business. We routinely assess the likelihood that such threats could result in a material impact to our Information Assets, business and clinical operations, core business functions, personnel, reputation and identified critical business objectives.

companyName: Lyell Immunopharma, Inc.

ticker: LYEL


text: Consistent with our overall risk management governance structure, management is responsible for the day-to-day management of cybersecurity risk while our Board and its Audit Committee play an active, ongoing oversight role.

companyName: MICROCHIP TECHNOLOGY INC

ticker: MCHP


text: Our Chief Information Security Officer (CISO) leads NACCO's cybersecurity program and is responsible for the management of our cybersecurity risks. The CISO has extensive cybersecurity knowledge and skills gained from over 30 years of technical and business experience, including as General Manager & President of MLMC, Vice President of Mississippi Operations and Vice President of Innovation & Technology. The CISO holds a bachelor's degree in engineering, an executive MBA, and certifications in cybersecurity from Harvard. Additionally, the CISO successfully completed an Executive course through Northwestern's Kellogg School of Management focused on artificial intelligence during 2024. The CISO reports directly to the President and Chief Executive Officer. The CISO manages a team of internal and external resources that have expertise and experience in cybersecurity. The CISO is informed of cybersecurity incidents by the cybersecurity team, which is generally responsible for monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. We have an established process governing our assessment, response and internal and external notifications upon the occurrence of a cybersecurity incident, including evaluation of the potential impacts of cybersecurity incidents to determine materiality. Depending on the nature and severity of an incident, this process provides for escalation procedures upon discovery of material cybersecurity risks, including notification to our executive management and/or Board.

companyName: NACCO INDUSTRIES INC

ticker: NC


text: During the year ended December 31, 2024, there were no cybersecurity incidents that materially affected or are reasonably likely to materially affect the Corporation.

companyName: ENB Financial Corp

ticker: ENBP


text: The Audit Committee receives regular reports from our Chief Financial Officer concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Vital Farms, Inc.

ticker: VITL


text: Third parties conduct periodic assessments on our cyber-related systems. To measure our non-nuclear cybersecurity framework maturity, we utilize internal and external audits and assessments, vulnerability testing, and governance processes. Our nuclear cybersecurity program is inspected biennially by the NRC and assessed annually by a quality assurance audit. Nuclear vulnerability management is implemented in collaboration with Department of Homeland Security and the Cybersecurity and Infrastructure Security Agency.

companyName: Talen Energy Corp

ticker: TLN


text: We leverage third-party cybersecurity companies to assess our cybersecurity program and procedures and reaffirm our compliance with SOC 2 standards as well as the HIPAA Security Rule. These assessments aid in continual improvement and help us identify and address risks from cybersecurity threats.

companyName: Option Care Health, Inc.

ticker: OPCH


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: Raphael Pharmaceutical Inc.

ticker: RAPH


text: The board of directors has risk oversight responsibility for Abbott, which it administers directly and with assistance from its committees. Throughout the year, the board and its committees engage with management to discuss a wide range of enterprise risks.

companyName: ABBOTT LABORATORIES

ticker: ABT


text: The Audit Committee of the board of directors oversees cybersecurity risk and is comprised of three independent members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. The chair of our Audit Committee holds a Certificate in Cybersecurity Oversight from the National Association of Corporate Directors and has previous work experience at a large retailer with point-of-sale cybersecurity exposure. The Audit Committee receives quarterly updates summarizing on-going information technology and cybersecurity initiatives from our Chief Financial and Administrative Officer and reviews the results of our annual risk assessment and regular cyber risk assessment upon completion. Any significant issues identified are reported to the Audit Committee of the board of directors on a quarterly basis. As described above, our management team is responsible for the day-to-day assessment and management of material risks from cybersecurity threats through our Chief Financial and Administrative Officer, our standing management committee on information technology and cybersecurity risk matters and the MSSP. This group would be notified through our Incident Response Plan/Policy and appropriate actions undertaken in accordance with the plan document if a cyber attack were to occur.

companyName: Piedmont Realty Trust, Inc.

ticker: PDM


text: We leverage third party cybersecurity companies to periodically assess our cybersecurity program and procedures and reaffirm our compliance with SOC 2 standards. These assessments aid in continual improvement and help us identify and address risks from cybersecurity threats.


text: Unique identification is assigned to all individuals with a defined relationship (e.g., employees, vendors, suppliers, etc.), and if a relationship changes, a new identifier is created to reflect the new relationship. Passwords must be changed upon first logon and all privileged account passwords (e.g., root, super user, and administrator passwords) must follow our password guidelines. Identification and authentication are required every time Medium or High Risk Information Assets are accessed or elevated privileges are exercised, and use of elevated privileges is temporary and is revoked upon implementation of a change.

companyName: Clene Inc.

ticker: CLNN


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: employee training; access controls; data encryption; systems monitoring; regular patching of operating systems and software; a Password Policy; a written IT Security Incident Response Plan; and cybersecurity insurance coverage.

companyName: Longboard Pharmaceuticals, Inc.


text: Consistent with overall risk management policies and practices, the Company's cybersecurity program focuses on the following areas:

companyName: Farmland Partners Inc.

ticker: FPI


text: Our Head of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Head of IT is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Silence Therapeutics plc

ticker: SLN


text: Representatives from our security team provide quarterly updates to the Audit Committee and/or Board of Directors regarding the Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.

companyName: Ibotta, Inc.

ticker: IBTA


text: The identification and assessment of cybersecurity risk are integrated into our overall risk management systems and processes, which are managed by senior management and overseen by the Board of Directors. Cybersecurity risks related to our business, privacy and compliance issues are identified and addressed through a multi-faceted approach that includes third party assessments, internal information technology (IT) audit, IT security, governance, risk and compliance reviews. In connection with the aforementioned approaches, and to defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security, and implement appropriate changes.

companyName: TEJON RANCH CO

ticker: TRC


text: The Committee has established a Cybersecurity Subcommittee (the "Subcommittee"). The Subcommittee consists of, among others, the CCO, the CTO, the chief financial officers of public companies that are subject to the SEC's cybersecurity rule adopted in 2023 and are managed by CIM Group, including our Chief Financial Officer. The Subcommittee is tasked with assisting CIM Group-managed public companies (that are subject to the SEC's cybersecurity rule adopted in 2023), including us, in complying with such cybersecurity rule.

companyName: CIM REAL ESTATE FINANCE TRUST, INC.

ticker: CMRF


text: Our board of directors is aware of, and takes seriously, the importance of overseeing risks associated with cybersecurity threats. Senior management has provided the board of directors with cybersecurity information, as well as incident response training. Additionally, employees have received training related to cybersecurity. Cyber risks are incorporated into risk appetite metrics for operational risk and presented to and reviewed by the risk committee of the board of directors. Additionally, the audit committee of the board of directors receives and reviews internal audit reports concerning, among other things, matters related to information security. Furthermore, the board of directors of Simmons Bank, the Company's primary operating subsidiary, has established an information technology committee ("IT Committee") that receives regular reports from the CISO and CIO concerning our information security program and cybersecurity matters. The CIO also reports IT KRIs, including those related to cyber risks, to the IT Committee. Significant security incidents are also reported by senior management to the IT Committee or its chairman, when warranted. The IT Committee chairman provides reports of the committee's activities to the board of directors of Simmons Bank. The Company's board of directors, or the board of directors of Simmons Bank (as applicable), also approves information security-related policies, including the Acceptable Use Policy, Information Security Policy, IT Ransomware Policy, and Business Continuity Management Policy.

companyName: SIMMONS FIRST NATIONAL CORP

ticker: SFNC


text: Information Security Program Vendor Management. The Company maintains a formally documented Vendor Management Program that includes an information security review of all new and existing third -party vendor relationships. The Vendor Management team ensures initial and ongoing due diligence is performed on all third -party relationships according to policy. Quarterly Vendor Management program updates are provided, and the policy is reviewed and approved annually by the Audit Committee of the Board of Directors.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: IT Risk and Vendor Management We rely on third-party service providers to leverage subject matter expertise and industry best practice, provide enhanced products and services, and reduce costs. Although there are benefits in entering into third-party relationships with vendors and others, there are risks associated with such activities. When entering a third-party relationship, the risks associated with that activity are not passed to the third-party but remain our responsibility. At the direction of the Board and pursuant to its ultimate oversight, management is charged with the development and maintenance of a comprehensive vendor management program. In that respect, Company management has appointed the IS Steering Committee, chaired by the Chief Information Officer, to oversee the Company's vendor management program. The vendor management program is used to identify, measure, monitor, and control the risks associated with outsourcing arrangements. While focusing on information and operational risks, outsourced relationships are reviewed through structured assessments and addressed from an end-to-end perspective. While we have implemented a vendor management program to actively manage the risks associated with the use of third-party service providers, any problems caused by third-party service providers could adversely affect our ability to deliver products and services to our customers and to conduct our business. Replacing a third-party service provider could also take a long period of time and result in increased expenses.

companyName: FARMERS & MERCHANTS BANCORP INC

ticker: FMAO


text: We recognize the importance of protecting our information and our information technology systems, and assessing, identifying and managing cybersecurity-related risks have been integrated into our risk management processes. We focus on information technology and cybersecurity measures at both an enterprise-wide operational level and an individual employee level. We have in place various methods and levels of information technology and cybersecurity measures which are aimed at protecting our information and information technology systems to help secure long-term value for our stockholders and other stakeholders. By way of example, these measures include the following:

companyName: Korth Direct Mortgage Inc.


text: JFG has a comprehensive cybersecurity incident response and communication plan (the "IRP"), managed by the Security Operations Group, which is designed to inform appropriate risk management and business managers (including, as appropriate, our executive officers and other representatives of the Investment Adviser or its affiliates) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate such an event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and law enforcement agencies. The IRP is reviewed at least annually.

companyName: Senior Credit Investments, LLC


text: We believe cybersecurity is of critical importance to our success. We are susceptible to a number of significant and persistent cybersecurity threats, including those common to most industries, as well as those we face as a retailer, operating in an industry characterized by a high volume of customer transactions and collection of sensitive data. These threats, which are constantly evolving, include data breaches, ransomware, and phishing attacks. We, and our vendors and suppliers, regularly face attempts by malicious actors to breach our security and compromise our information technology systems, and a cybersecurity incident impacting us or any vendor or supplier could significantly disrupt our operations and result in damage to our reputation, costly litigation and/or government enforcement action. Accordingly, we are committed to maintaining robust cybersecurity and data protection and continuously evaluate the impact of cybersecurity threats, considering both immediate and potential long-term effects of these threats on our business strategy, operations, and financial condition.

companyName: Boot Barn Holdings, Inc.

ticker: BOOT


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident.

companyName: ECD Automotive Design, Inc.

ticker: ECDA


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders, including a member of the Board meet at least monthly in our Security Steering Committee (the "Security Committee") to develop strategies for preserving the confidentiality, integrity and availability of our company and customer information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.

companyName: authID Inc.

ticker: AUID


text: Although the Company has designed its cybersecurity program and oversight to mitigate cybersecurity risks, the Company faces unknown cybersecurity risks, threats, and attacks. To date, these risks, threats or attacks have not had a material impact on the Company's operations, business strategies or financial results, but the Company cannot provide assurance that they will not have a material impact in the future. See Item 1A - Risk Factors above for additional discussion of various cybersecurity risks.

companyName: NATIONAL PRESTO INDUSTRIES INC

ticker: NPK


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's policies and processes through audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity controls and oversight. Third-party audits and independent reviews of our cybersecurity measures, information security control environment and operating effectiveness are conducted on at least an annual basis to assist us with enhancing, implementing and monitoring our cybersecurity risk management programs.

companyName: PHINIA INC.

ticker: PHIN


text: We have a multi-disciplinary Cybersecurity Council that connects our Information Security, IT, Corporate Audit, Finance, Legal, Compliance, and Investor Relations teams. This Council facilitates coordination of cybersecurity risk management across our organization and a unified response to incidents. In the event of a cybersecurity incident, the ISO will lead our incident response efforts and convene the Cybersecurity Council to evaluate the situation and determine appropriate next steps (for example, engaging law enforcement or cyber-experts, and considering disclosure obligations). This integrated governance structure – from the operational teams up through senior management and the Board – helps drive accountability and visibility for cybersecurity throughout our organization.

companyName: OSI SYSTEMS INC

ticker: OSIS


text: We use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including, for example: a third-party IT and cybersecurity consultant; professional services firms, including legal counsel; threat intelligence service providers; cybersecurity software providers; managed cybersecurity service providers; penetration testing firms; dark web monitoring services; and forensic investigators.

companyName: UroGen Pharma Ltd.

ticker: URGN


text: As an externally managed company, the Company relies on CTO's information systems in connection with the Company's day-to-day operations. Consequently, the Company also relies on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by CTO. All of the Company's executive officers are executive officers and employees of CTO, and one of the Company's officers (John P. Albright) is also a member of CTO's board of directors.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: In alignment with industry standards, such as the NIST Cybersecurity Framework, and FHFA regulatory guidance, we have implemented processes for assessing, identifying, and managing cybersecurity risk through a layered approach throughout our environment and in our service provider arrangements, including SaaS and IaaS engagements. We endeavor to continuously develop our policies and practices to mitigate our exposure to cybersecurity risks given, among other things, the evolving natures of these risks, the involvement of uncontrollable circumstances, such as fires or flooding, and our role in the financial services industry and the broader economy. Our cybersecurity risk-mitigating processes include, but are not limited to the following: performing regular risk assessments to identify, understand, and prioritize risks from cybersecurity threats; the implementation of firewalls, anti-virus software, and real-time network monitoring; the deployment of software updates to address security vulnerabilities; maintaining a vulnerability management program to timely identify and remediate cybersecurity risks, and; periodic employee training to educate employees on how to identify and avoid various forms of social engineering.

companyName: Federal Home Loan Bank of Boston


text: The Vice President of IT acts as our head of information security in leading our information security organization. Our VP of IT has over 20 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies.

companyName: ONTO INNOVATION INC.

ticker: ONTO


text: The Company has a written incident response plan ("IRP") and conducts tabletop exercises to enhance incident response preparedness. Disaster recovery plans are used to prepare for the potential for a disruption in technology we rely on. Employees undergo security awareness training, including phishing simulation training, when hired and periodically throughout the year.

companyName: BASSETT FURNITURE INDUSTRIES INC

ticker: BSET


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms including legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, forensic investigators, and penetration testing firms.

companyName: Sweetgreen, Inc.

ticker: SG


text: We require all of our employees to receive cybersecurity training as part of their initial onboarding process, and employees are required to complete additional training throughout the year.

companyName: FONAR CORP

ticker: FONR


text: Constellation has established programs and processes to manage material risks from cybersecurity threats including assessing and identifying existing cybersecurity risks, as well as continuously monitoring for developing risks. Our cybersecurity risk management strategy is established at the executive level and is implemented through our cybersecurity program which deploys risk-based security controls and services to protect our customers, personnel, information and cyber assets. The program aligns enterprise cyber and physical security controls with the National Institute of Standards & Technology (NIST) Cybersecurity Framework (CSF) and other industry standards such as the NERC and NRC cybersecurity standards. Our cybersecurity program is aligned to the five functions of the NIST Cybersecurity Framework – identify, detect, protect, respond, and recover. Cybersecurity risk is assessed and reported in our enterprise risk management program, which utilizes the Three Lines Model adapted from the Institute of Internal Auditors, for risk management to assign clear risk responsibilities across the enterprise. Through coordination with operational teams, we align on cybersecurity risk classification, categorization, likelihood, and potential impact to the company. At the highest level, our program includes multi-layered oversight by the Board of Directors and Board Committees.

companyName: CONSTELLATION ENERGY GENERATION LLC


text: Reporting to our Board Given the importance of information security and privacy to our stakeholders, our Board receives an annual report from our CSO to discuss our program for managing information security risks, including cyber and data security risks. The Risk Committee also receives periodic briefings on data privacy from the Chief Privacy and Data Responsibility Officer. Our Risk Committee receives regular reports on our cyber readiness, our risk profile status, our cybersecurity programs, material cybersecurity risks and mitigation strategies, third-party assessments of our cybersecurity program and other cybersecurity developments. The Risk Committee chair provides reports to the Board on such topics. In addition, our Board and the Risk Committee also receive information about these topics as part of regular business and legal and regulatory updates. In addition, we engage directors as part of cybersecurity and data breach incident simulations.

companyName: Mastercard Inc

ticker: MA


text: We take cybersecurity threats seriously, including regular assessment of cybersecurity risks both internally and with third party assistance and updates to the Board of Directors at least annually. We use the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) as the basis for the information security management system. As we implement new technologies, the NIST CSF is used as the guiding framework. Among other best practices, we use multi-factor authentication wherever possible for external access to systems, assess and update current versions of security solutions, perform regular cybersecurity training and email phishing campaigns for employees, use third parties to perform external penetration testing, and maintain disaster recovery and incident response plans, which include retainer contracts for third party cybersecurity response specialists. We employ a combination of methods to monitor for new or developing cybersecurity risks.

companyName: STRATTEC SECURITY CORP

ticker: STRT


text: We do not believe that risks from cybersecurity threats, including the previously disclosed cyber-attack that occurred in April 2023, have materially impacted or are reasonably likely to materially impact our overall business strategy, results of operations, or financial condition. We maintain cybersecurity insurance to cover the costs resulting from cyber-attacks; however, the policy may not cover all losses from cybersecurity incidents. Refer to the discussion on the April 2023 incident in Note 23 of our financial statements and the discussion of cybersecurity risk in Part I, Item 1A, "Risk Factors".

companyName: MIDDLEFIELD BANC CORP

ticker: MBCN


text: We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our internal information technology policies which are inclusive of cybersecurity policies, processes, and practices. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our Cyber Security Committee, which is comprised of representatives from our business operations and support functions, assesses risks based on current risks we are aware of, probability and potential impact to key business systems and processes. Risks that are considered high are incorporated into our overall risk management program. A mitigation plan is developed for each identified high risk, with progress reported to the Cyber Security Committee and tracked as part of our overall risk management program overseen by the Audit Committee of our board of directors.

companyName: Biomea Fusion, Inc.

ticker: BMEA


text: The CISO is also responsible for supervising and monitoring certain outside professionals or third-party service providers that assist in enhancing the Company's current cybersecurity safeguards. The Company has invested meaningful resources to address cybersecurity threats and partners with leading technology companies to implement solutions to address the fast-evolving threat landscape. These solutions and services help with the prevention, detection, mitigation and remediation of cybersecurity threats and incidents.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: Among management, our Chief Technology Officer ("CTO") and our Chief Information Security Officer ("CISO") are responsible for leading efforts to assess and manage cybersecurity risks. Our CTO has over 20 years of experience leading technology teams and developing applications and other digital solutions for commerce, incorporating the assessment and management of cybersecurity risk, a Master's degree in Engineering Management and a Bachelor's degree in Computer Science. Our CISO has over 20 years of experience assessing and managing cybersecurity risk, including leading information security teams at complex web-based businesses, and has a Master's degree in Computer Information Systems and multiple professional, cybersecurity and certifications, including CISM, CDPSE, CIPM, CIPT, and PMP.

companyName: Frontdoor, Inc.

ticker: FTDR


text: Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate. Blue Owl has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.

companyName: Blue Owl Capital Corp II


text: We also have implemented an incident response plan that is designed to facilitate our response to cybersecurity incidents and escalation of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us, to our executive officers, other members of our senior management team and other internal stakeholders. This plan is designed to provide our executive officers and other members of our senior management team with the information needed to assess the materiality of a cybersecurity incident and the need for public disclosure. The incident response plan is tested annually to assess its operational effectiveness. We conduct an annual "tabletop" exercise during which we simulate cybersecurity incidents to help us prepare to respond to a cybersecurity incident and to identify areas for potential improvement. These exercises are conducted in close coordination with members of our internal cybersecurity risk management team, our retained cybersecurity incident response consultants, outside cybersecurity counsel and internal technical, operations, insurance risk management, internal audit and legal personnel, as well as certain executive officers and members of the senior management team.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by the Company's Principal Executive Officer and Principal Financial Officer, along with the Company's managed services provider, which monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, the Company's Principal Executive Officer and Principal Financial Officer reports to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, on an annual basis.

companyName: SYNLOGIC, INC.

ticker: SYBX


text: We continue to assess and improve the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. We value the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security law. Our cybersecurity risks, and the controls designed to mitigate those risks, are included as a part of our overall risk management governance which is reviewed at least annually by our board of directors.

companyName: CV Sciences, Inc.

ticker: CVSI


text: Prevention and Preparation Our Advisor employs a variety of measures to prevent threats related to privacy, information technology security and cybersecurity, which include password protection, frequent mandatory password change events, multi-factor authentication, internal phishing testing, vulnerability scanning and penetration testing.

companyName: Net Lease Office Properties

ticker: NLOP


text: Cyber Risk Management and Strategy We have adopted cybersecurity risk management activities and processes that are informed by and incorporate elements of recognized industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework, and that are designed to identify, assess, and mitigate critical risks from cybersecurity threats. We have, for example, implemented a process to monitor for potential critical risks from cybersecurity threats using automated tools. To support our cybersecurity risk management efforts, we leverage a managed service provider that provides ongoing support for the protection of our information technology infrastructure.

companyName: ImageneBio, Inc.

ticker: IMA


text: For control efficacy, the cybersecurity program leverages a variety of metrics and measurements to demonstrate whether the control objectives are being consistently achieved within the target range. Monthly security operation (SecOps) reviews are utilized to monitor metric trends and root causes to determine potential capability improvements. The monthly SecOps reviews and related actions are aggregated into a subset of key metrics reviewed quarterly by the Audit Committee.

companyName: REPUBLIC SERVICES, INC.

ticker: RSG


text: The Company recognizes the importance of being able to assess, effectively respond to and manage material cybersecurity threats and incidents that may compromise the confidentiality, integrity or availability of its information systems, data or network resources.

companyName: QUANTUM CORP /DE/

ticker: QMCO


text: Annual vulnerability assessments and penetration testing, as well as periodic web application and internal network scanning, are performed by third party service providers as directed by the Company's Managed Service Provider ("MSP"). The results of these tests are shared with the CFO by the MSP. We have processes in place to evaluate the potential risks from cybersecurity threats associated with our use of third-party service providers that have access to our data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirement and system monitoring. The Company also partners with a breach protection platform to provide ongoing, self-guided cybersecurity training to its employees to reduce risk from phishing, social engineering and password-related attacks.

companyName: KOSS CORP

ticker: KOSS


text: We are committed to protecting our third parties' and our data. Despite efforts, our systems, products, and services remain vulnerable to attacks.

companyName: Bannix Acquisition Corp.


text: Company is committed to maintaining the highest standards of cybersecurity to protect our data, intellectual property, and customer information from cyber threats. As part of this commitment, we leverage a sophisticated cybersecurity framework that integrates the robust capabilities of the Microsoft cloud ecosystem with the specialized services of a leading third-party cybersecurity service provider.

companyName: IMPACT BIOMEDICAL INC.

ticker: IBO