text: Our management team, including our Chief Financial and Business Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal IT personnel who in turn manage our retained external cybersecurity consultants. Our management team's experience includes significant responsibility for developing and maintaining cybersecurity risk management programs and for managing cybersecurity risks prior to joining us.

companyName: Phathom Pharmaceuticals, Inc.

ticker: PHAT


text: Lightbridge also utilizes third-party vendors to manage its cybersecurity needs via a Managed Services Security Provider (MSSP). MSSP services include: Managed Security Services Email Phishing Simulations End User Security Awareness Training Dark Web Credential Monitoring Vulnerability Scanning Next-Generation Anti-Virus ("NGAV")

companyName: LIGHTBRIDGE Corp

ticker: LTBR

secItem: Item 1C


text: Management Oversigh t The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Chief Financial Officer ("CFO") in connection with our managed service provider. Our managed service provider is a System and Organization Controls ("SOC") 2 accredited IT services firm which completes required annual audits, providing evidence of ongoing compliance to maintain the SOC 2 designation. They have over a decade of experience delivering services and consulting for regulatory security requirements. Our managed service provider is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and are regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. The managed service provider provides regular briefings for our senior management team on cybersecurity matters, including threats, events and program enhancements.

companyName: Perspective Therapeutics, Inc.

ticker: CATX


text: Our Board understands the importance of maintaining a robust and effective cybersecurity program. The Audit and Finance Committee of the Board oversees the Company's cybersecurity program as well as risk exposures and steps taken by management to monitor and mitigate cybersecurity risks. The CISO and/or CDTO provide a quarterly update on the cybersecurity program, on an alternating basis to the Audit and Finance Committee or the full Board.

companyName: GAP INC

ticker: GAP


text: Our Chief Information Security Officer ("CISO") provides quarterly updates to the Audit and Risk Committee, as well as an annual report to the Board, regarding a range of cybersecurity activities while maintaining the confidentiality, integrity, and availability of information, including user information under our custody. There are also scheduled monthly meetings where, among others, our CISO, Head of Privacy and a representative of the Sponsor attend, in order to discuss our cybersecurity program, including evaluating the implementation of additional controls, processes, policies, and procedures, as appropriate, as well as any notable security incidents, if any. Our CISO joined the Company in the role of Chief Information Security Officer almost four years ago, and has over 20 years of experience in the field of cybersecurity. He is supported by and leads our Information Security team, which includes the first responders to cybersecurity incidents.

companyName: Bumble Inc.

ticker: BMBL


text: This cyber risk management program is integrated into TIAA's overall risk management program. It involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Account relies. TIAA relies on its internal subject matter experts and external experts, as needed, including but not limited to cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes, applicable to the Account and other products, subsidiaries, and affiliates of TIAA.

companyName: TIAA REAL ESTATE ACCOUNT


text: Our cybersecurity program is integrated into our overall risk management systems, including our annual enterprise risk management program, internal audit program, business continuity and crisis management programs, third-party risk management program, insurance risk management program, and employee compliance programs. As part of our overall risk management program, we maintain a global insurance portfolio with comprehensive cyber coverage. Our Chief Information Security Officer ("CISO") and the Information Security function advises, consults with, or provides input to each of these programs to ensure that material risks from cybersecurity threats are appropriately assessed, identified, and managed.

companyName: VERTEX PHARMACEUTICALS INC / MA

ticker: VRTX


text: The CISO monitors and reviews our process of patching compliance, which is managed and executed via a combination of internal resources and third-party service providers. We also use third parties to supplement monitoring of cyber activity and for various special projects, which may include projects related to cybersecurity.

companyName: Spirit AeroSystems Holdings, Inc.


text: We are subject to cybersecurity threats that could have a material adverse impact on our results of operations, financial condition and cash flows, as well as our operations—including our manufacturing and marketing capabilities. We operate a risk-based cybersecurity program which is designed to: (i) ensure the security, confidentiality, integrity and availability of our information and systems; (ii)

companyName: HARROW, INC.

ticker: HROW


text: We have integrated our cybersecurity risk management program into our broader enterprise risk management program. This integration is designed to make cybersecurity considerations an integral part of our decision-making processes at every level and we believe that this integration allows cybersecurity risks to be evaluated and addressed in alignment with our business objectives and operational needs. While we work to maintain our information security program and risk management efforts, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to our systems, networks, and data or those of our third-party providers.

companyName: TECOGEN INC.

ticker: TGEN


text: Bank customers are also sources of cybersecurity risk to the Bank and its information assets, particularly when their activities and systems are beyond the Bank's own security and control systems. The Bank provides information to its customers and other external parties concerning cybersecurity risks including opportunities to reduce cybersecurity risk.

companyName: RBB Bancorp

ticker: RBB


text: Key's CISO oversees the IS Program and its related policies and is responsible for determining whether relevant security risk information is properly integrated into strategic and business decisions, overseeing the appropriate identification and ownership of security risks, monitoring critical risks, and maintaining the appropriate oversight and governance of information security through associated programs and/or standards. Our CISO has served in various roles in information technology and information security at Key for over 29 years, including serving as Enterprise Security Executive. The CISO holds a B.S.B.A in Management Information Systems.

companyName: KEYCORP /NEW/

ticker: KEY


text: As discussed above, we maintain an IRP that guides our response to a cybersecurity incident. Annually, we test the IRP's response procedures, including thorough disaster response and business continuity plan exercises. These exercises are intended to challenge and validate our information security response and resources through simulated cybersecurity incidents, including engagement of outside cybersecurity legal counsel, other third-party partners, key internal personnel, executive management, and our Board.

companyName: Public Storage

ticker: PSA


text: Our Executive Leadership Team is responsible for managing enterprise risk, which is inclusive of cybersecurity. The Chief Information Officer ("CIO"), a member of the Executive Leadership Team, and the Chief Information Security Officer ("CISO"), who reports to the CIO, are responsible for assessing and managing cybersecurity risk, including the prevention, detection, mitigation, and remediation of cybersecurity incidents. The CIO has over 30 years of experience in Information Technology and Operations including executive-level experience within the consumer goods industry. The CISO possesses relevant expertise in cybersecurity, including 25 years in both IT and cybersecurity.

companyName: Crocs, Inc.

ticker: CROX


text: Key elements of the comprehensive Information Security Program include: • A mix of administrative and technical tools and controls appropriate to the size and complexity of the Bank to protect the confidentiality, integrity, and availability of critical systems and data, including the privacy of customer data, in compliance with applicable laws, rules, and regulations. Control coverage includes Board approved policies, layers of network security, encryption of data at rest and in transit, vulnerability scans of technology assets, logging and monitoring, identity and access management, secure coding, and email security. • Risk assessments are conducted to: (a) identify reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of critical Bank systems and data, (b) determine the likelihood and potential impact of the threats, and (c) determine the sufficiency of controls and mitigating factors to reduce the risks identified. • A detailed Cyber Incident Response Plan which includes engagement of a third-party that specializes in cybersecurity for financial institutions to assist in incident response and recovery and communications with the Board, regulators, law enforcement and Federal and State Government offices, as required. While the Bank has not experienced a business-impacting cyber incident to date, the Cyber Incident Response Plan is tested at least annually and updated as required so that personnel are prepared for an actual incident. In addition, targeted cybersecurity playbooks are maintained to respond to common threats, including malware, ransomware and denial of service attacks. • Security Awareness training to help employees understand their information protection and cybersecurity responsibilities, including targeted campaigns on phishing and other common social engineering techniques utilized by threat actors. • A third-party risk management program to classify suppliers according to risk and identify those that require enhanced cyber due diligence. • Annual independent third-party penetration tests, external vulnerability scans, assessments and audits of the Bank's Information Security Program elements.

companyName: BayFirst Financial Corp.

ticker: BAFN


text: BlackRock's Cybersecurity Governance BlackRock's Board is actively engaged in the oversight of BlackRock's risk management program. BlackRock's Risk Committee assists BlackRock's Board with its oversight of BlackRock's levels of risk, risk assessment, risk management and related policies and processes, including risks arising from cybersecurity threats. BlackRock's Risk Committee receives regular reports on BlackRock's cybersecurity program, technology resilience risk management and related developments from members of our information security team, including the CISO. BlackRock's Board and BlackRock's Risk Committee also receive information regarding cybersecurity incidents that meet certain reporting thresholds. On an annual basis, senior members of BlackRock's technology, risk and information security teams provide a comprehensive overview of BlackRock's cyber risk and related programs to a joint session of BlackRock's Board's Risk and Audit Committees.

companyName: iShares Gold Trust Micro

ticker: IAUM


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity incident response plan is also designed to integrate with or complement other enterprise plans, such as our business continuity plan and crisis management plan.

companyName: Intapp, Inc.

ticker: INTA


text: We have an Enterprise Risk Management Committee that is led by our Assurance and Risk Advisory Services group, our Chief Financial Officer and our Chief Administrative Officer, with participation from our executive leadership team and senior-level staff, including our Chief Compliance Officer and the CISO. This committee assesses and monitors our top enterprise risks, including cybersecurity, and provides quarterly updates to the board of directors. Our CISO also provides periodic updates to the finance and audit committee of the board of directors, which is responsible for ensuring that we have implemented appropriate risk reviews and discusses, with management and the board, our financial and enterprise risk assessment and risk management practices and policies, as well as reports to the board any material risks identified in the course of performing its responsibilities.

companyName: DELUXE CORP

ticker: DLX


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. For more information, see Item 1A. Risk Factors. The pharmaceutical industry is highly competitive and is subject to rapid and significant technological change, which could render our technologies and products obsolete or uncompetitive.

companyName: X4 Pharmaceuticals, Inc

ticker: XFOR


text: Information regarding these threats is then built into our security tools. This takes the form of hardening systems through vulnerability identification and patching, as well as enabling early detection and response capabilities across our network and endpoints. Any detected threat or potential cybersecurity incident is handled by our hybrid Security Operations Center, or "SOC" which utilizes both internal and external resources for monitoring 24/7 and is responsible for triaging and appropriately handling or escalating the potential incident.

companyName: WYNDHAM HOTELS & RESORTS, INC.

ticker: WH


text: The Customers' Board of Directors periodically reviews and determines Customers' cyber risk tolerance level. The Statement of Cyber Risk Appetite is kept on record by Customer's Enterprise Risk Management team. The Customers' IT Risk Assessment and FFIEC Cybersecurity Assessment are presented annually to the Customers' Directors' Risk Committee and Board of Directors, identifying Customers' cybersecurity risk posture, with recommendations for reduction as deemed appropriate by the Customers' Directors' Risk Committee and Board of Directors. The FFIEC Cybersecurity Assessment will be phased out on August 31, 2025, with Customers introducing an annual NIST CSF 2.0 assessment in its place.

companyName: Customers Bancorp, Inc.

ticker: CUBI


text: The Company's cybersecurity efforts are directly overseen by our Director of Information Technology, who reports directly to our Chief Executive Officer. The Company's Board of Directors is made aware of cybersecurity incidents and threats, as appropriate, pursuant to corporate policy.

companyName: Legacy Housing Corp

ticker: LEGH


text: Patrick Doyle. Mr. Doyle, age 61, has served as Executive Chair of our Board since January 2023 and was appointed Executive Chairman of RBI in November 2022. Most recently, he served as an executive partner focused on the consumer sector of the Carlyle Group, a global diversified investment firm from September 2019 through November 2022. Prior to that he served as the chief executive officer of Domino's Pizza from March 2010 to June 2018, having served as president from 2007 to 2010, as executive vice president of Domino's Team USA from 2004 to 2007 and as executive vice president of Domino's International from 1999 to 2004.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: Related to Cybersecurity Risks The cybersecurity risk management program and related operations and processes are directed by WisdomTree Inc.'s CIO. Currently, the CIO role is held by an individual who has been in the role for over ten years, has over 23 years of cybersecurity, information technology and systems engineering experience, and has advanced training in the field of technology.

companyName: WisdomTree Bitcoin Fund

ticker: BTCW


text: We have established controls and procedures to escalate enterprise level issues, including cybersecurity matters, to the appropriate management levels within our organization and our Board of Directors, or members or committees thereof, as appropriate. Under our framework, cybersecurity issues, including those involving vulnerabilities introduced by our IT, OT systems and use of third-party software, are analyzed by subject matter experts, including a crisis committee as needed in accordance with our incident response plans, for potential financial, operational, and reputational risks, based on, among other factors, the nature of the matter and breadth of impact. Matters determined to present potential material impacts to our financial results, operations, and/or reputation are immediately reported by management to the Board of Directors, or individual members or committees thereof, as appropriate, in accordance with our established escalation framework. In addition, we have established procedures to help ensure that members of management responsible for overseeing the effectiveness of disclosure controls are informed in a timely manner of known cybersecurity risks and incidents that may materially impact our operations and that timely public disclosure is made, as appropriate.

companyName: BOSTON SCIENTIFIC CORP

ticker: BSX


text: Cybersecurity Identified Risks As of the date of the filing of this Current Report on Form 10-K, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, nor are they reasonably likely to affect, us, including our business strategy, results of operations, or financial conditions.

companyName: Crane NXT, Co.

ticker: CXT


text: The above cybersecurity risk management processes are integrated into the Partnership's overall risk management program. Cybersecurity threats are understood to be dynamic and intersect with various other enterprise risks. As such, cybersecurity is considered as an important component of our enterprise-wide risk management approach. We have assembled a Cybersecurity Steering Committee comprised of IT management, cybersecurity specialists, and representatives of business management, including the CTO and internal legal counsel. The Cybersecurity Steering Committee reviews information security policies and cybersecurity risks in conjunction with other operational, financial, and strategic risks to ensure alignment with our business objectives. The Cybersecurity Steering Committee convenes regularly to review and monitor the Partnership's programs for the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Cybersecurity Steering Committee receives reports on security incidents, threat intelligence, and vulnerability assessments from our IT Security Department.

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity defense strategy based on prevention, detection and containment. We employ industry standard measures directly or indirectly related to cybersecurity, such as multifactor authentication, endpoint protection defenses, antivirus protection, encryption standards, restricting access based on business necessity, and remote access monitoring. Our employees undergo regular cybersecurity awareness training, receive guidance on protecting confidential information, and participate in simulated phishing exercises. The training provides employees with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. We engage third parties to conduct penetration testing and evaluate our adherence to industry-standard frameworks. We assess the security framework employed by our third party service providers including their reports on security, availability and confidentiality to assess and identify material risks from cybersecurity threats associated with our use of third party applications. We have also established liaison programs with the Federal Bureau of Investigation ("FBI") and U.S. Cybersecurity & Infrastructure Security Agency ("CISA") to monitor, identify, and counter advanced persistent threats specific to our company and industry. As part of this program, we have an FBI Special Agent assigned as our Liaison Officer who provides us with periodic cybersecurity threat briefings, and also provides counter-threat support on request.

companyName: AST SpaceMobile, Inc.

ticker: ASTS


text: Our Chief Financial Officer, who reports directly to our Chief Executive Officer, is responsible for assessing and managing Gyre Therapeutics' cybersecurity risks with support from the Managed Service Provider, which employs IT consultants with over 20 years of experience managing information technology and cybersecurity matters and are certified as Microsoft Certified Systems Engineers. Our Gyre Pharmaceuticals IT department senior supervisor, who reports directly to our General Manager at Gyre Pharmaceuticals and has over 20 years of experience managing information technology and cyber security matters, is responsible for assessing and managing Gyre Pharmaceuticals' cybersecurity risks. Our General Manager at Gyre Pharmaceuticals reports the Board of Directors. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Breach, failure or disruption in or to our information system could compromise sensitive information related to our business and expose us to liability or reputational harm, and our ability to effectively manage our business operations could be adversely affected."

companyName: GYRE THERAPEUTICS, INC.

ticker: GYRE


text: The Company's cybersecurity risk management activities include basic safeguards intended to protect its business information, customer data, and website operations, including access controls, routine monitoring of systems, and the use of third-party service providers for website hosting, e-commerce, and data storage.

companyName: REST EZ Inc.

ticker: RTEZ


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, could have a material adverse effect on us including an adverse effect on our business, financial condition and results of operations. See "Risk Factors—General Risks—Cybersecurity risks and cyber incidents or the failure to comply with laws and regulations concerning data privacy and security may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, any of which could have a material adverse effect on us."

companyName: Peakstone Realty Trust

ticker: PKST


text: Day-to-day responsibility for managing cybersecurity risks rests with senior management, including the Chief Operating Officer, with support from external cybersecurity advisors. Management is responsible for overseeing the Company's prevention, detection, and response measures, as well as the development of incident response and recovery plans. Management receives updates from third-party service providers, consultants, and internal staff, and reports these matters to the Board of Directors or the Audit Committee on a scheduled basis.

companyName: VERDE RESOURCES, INC.

ticker: VRDR


text: The Board of Directors recognizes that an encompassing, effective cybersecurity risk management strategy is essential to sustaining business operations and investor confidence. Our management assumes executive responsibility for assessing, identifying, and managing cybersecurity risks and incidents.

companyName: SERVICE CORP INTERNATIONAL

ticker: SCI


text: The scope of the risk assessment process includes but is not limited to the following asset types: a. Applications b. Business units h. Security infrastructure m. Cloud.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: The Director of Information Security, reporting to and collaborating with the Chief Information Officer, manages our Enterprise Cybersecurity team. Day-to-day responsibilities include the implementation of cybersecurity strategies, cybersecurity risk management, and enhancing defenses against evolving threats. Our Director of Information Security has over 30 years of IT experience, 10 of which have been spent leading the Company's cybersecurity efforts. The Information Security plays a key role in shaping our cybersecurity strategy, ensuring alignment with industry standards and integration into our broader IT strategy.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: The Company's management has processes in place by which it is informed of and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks. These processes include, but are not limited to: • Maintaining an updated inventory and management of digital assets; • Ensuring familiarity and compliance with cybersecurity frameworks, including the National Institute of Standards and Technology's Cybersecurity Framework and ISO 27001; • Updating and maintaining an internal incident response plan; • Conducting risk assessments of the Company's cybersecurity policies, practices, and tools; • Employing appropriate antivirus, anti-malware, firewall, endpoint detection and response, backup and recovery software, multifactor authentication, virtual private network, account change monitoring, patch management, web content filter, spam filter and reporting, and vulnerability management software; • Conducting regular vulnerability scans of the Company's digital and operational infrastructure; • Requiring employees to complete a Cybersecurity Awareness Program, which includes computer-based training; and • Reviewing and evaluating developments in the threat landscape.

companyName: Summit Midstream Corp

ticker: SMC


text: To date, the Company is not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on the Company, including its business strategy, results of operations, or financial condition. However, despite our security measures, there can be no assurance that the Company, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us. We describe whether and how cybersecurity-related risks could materially affect our business in item 1A. "Risk Factors" under the heading "Increased cybersecurity requirements, vulnerabilities, threats, and more sophisticated and targeted cyber crimes pose a risk to our systems, networks, products, solutions, services, and data, as well as our reputation, which could adversely affect our business." CYBERSECURITY GOVERNANCE.

companyName: GE HealthCare Technologies Inc.

ticker: GEHC


text: To date, no cybersecurity incident has resulted in any material impact on our business, operations or financial results or our ability to service our customers or run our business.

companyName: CSP INC /MA/

ticker: CSPI


text: Our cybersecurity risk management program is being designed based on various cybersecurity frameworks, including National Institute of Standards and Technology and the Center for Internet Security, as well as information security standards issued by the International Organization for Standardization, including ISO 27001 and ISO 27002. The Company uses these frameworks and information security standards as a guide to identify, assess, and management cybersecurity risks relevant to the business. Formalization and implementation of robust IT security policies; Conducting vulnerability assessments; Revision of user access request documentation to clearly define the roles and permissions assigned to users; of the accuracy and completeness of user listings and access;

companyName: Sensus Healthcare, Inc.

ticker: SRTS


text: Encryption and Data Protection Encryption methods are used to protect sensitive data. This includes the encryption of employee laptops, customer data, financial information, and other confidential data.

companyName: Sitio Royalties Corp.


text: We maintain a comprehensive information and cybersecurity and data privacy program to safeguard the security, confidentiality, integrity, availability and protection of the Company's and our clients' information. We aim to continually strengthen our cybersecurity posture and protocols. We have invested in people, processes and technology intended to protect information throughout the business life cycle and to manage cybersecurity risk, and we intend to continue to do so as cybersecurity risks and methods for preventing against them evolve. We provide no assurance that the policies and procedures outlined below will be properly followed in every instance or that they will be effective in safeguarding against every possible cybersecurity threat.

companyName: ExlService Holdings, Inc.

ticker: EXLS


text: Our Board of Directors is aware of the critical nature of managing the risks associated with cybersecurity threats. The Board of Directors has established oversight mechanisms to ensure effective governance in managing these risks.

companyName: INNODATA INC

ticker: INOD


text: The Bank's ability to respond to security incidents in a planned and coordinated fashion is important to the success of its information systems security program. The IRP has been developed to provide protections for both the Bank and the Bank's customers and to mitigate the negative effects of cybersecurity events or security breaches on the Bank itself. Program also identifies the Bank's Information Security Response Team (ISIRT) Policy and program procedures which are tested annually.

companyName: River Financial Corp

ticker: RVRF


text: We have a cybersecurity program to assess, identify, and manage risks from cybersecurity threats. The Company's cybersecurity program includes administrative, technical, and physical safeguards that address our information systems, including our IT and operational technology environments. The program is designed to ensure the confidentiality, security, integrity, and availability of those systems and the information residing therein.

companyName: Valaris Ltd

ticker: VAL


text: Our Vice President of Information Security, or the VP, IS, leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees and third-party service providers to address cybersecurity risks. The VP, IS's cybersecurity training includes 25 years of experience building and maintaining cybersecurity programs, and he obtained his certified information systems security professional, or CISSP, certification from the International Information System Security Certification Consortium, or ISC2, and his Cybersecurity and Infrastructure Security Agency, or CISA, certification from ISACA.

companyName: Beam Therapeutics Inc.

ticker: BEAM


text: We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.

companyName: Avalon GloboCare Corp.

ticker: ALBT


text: The Board of Directors receives presentations and reports on cybersecurity, which address a range of topics including recent developments, evolving standards, the threat environment, cybersecurity systems testing and vulnerability assessments, and the Company's practices and policies to manage risks. The CISO and ISSO report to the Board of Directors on cybersecurity matters and materials risks, if any, from cybersecurity threats. The Board of Directors also receive notice of any significant cybersecurity incidents, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Cycurion, Inc.

ticker: CYCU


text: Our cybersecurity risk management program is being designed based on various cybersecurity frameworks, including National Institute of Standards and Technology and the Center for Internet Security, as well as information security standards issued by the International Organization for Standardization, including ISO 27001 and ISO 27002. The Company uses these frameworks and information security standards as a guide to identify, assess, and management cybersecurity risks relevant to the business. Formalization and implementation of robust IT security policies; Conducting vulnerability assessments; Revision of user access request documentation to clearly define the roles and permissions assigned to users; Thorough review of the accuracy and completeness of user listings and access;

companyName: High Roller Technologies, Inc.

ticker: ROLR


text: The board of directors receives periodic reports from management and its designees concerning the Company's significant cybersecurity threats and risks, and the processes the Company has implemented in an effort to address them. The board of directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: Our cybersecurity risk management program, which is informed by and incorporates elements of recognized industry standards, is designed to identify, assess, and mitigate critical risks from cybersecurity threats. This program includes, but is not limited to, ongoing monitoring for potential critical risks from cybersecurity threats using automated tools. To support our cybersecurity risk management program, we leverage a managed service provider (MSP) that provides ongoing support for the protection of our information technology infrastructure as well as a virtual Chief Information Security Officer, or vCISO. Our cybersecurity risk management strategy is informed by periodic conversations with, and risk assessments conducted by, our vCISO.

companyName: Disc Medicine, Inc.

ticker: IRON


text: Our cybersecurity risk program also includes a documented incident response plan to be used in the event of a cybersecurity incident. The incident response plan provides for certain responses based on various factors of a cybersecurity incident.

companyName: Celanese Corp

ticker: CE


text: Cybersecurity is integrated into our enterprise risk management ("ERM") process. Cybersecurity-related risks are included in our ERM risk register, which are reviewed by internal stakeholders who designate the relative level of severity of identified risks. The ERM risk register, which includes any identified cybersecurity-related risks, is reviewed by our Executive Management Committee and is reported quarterly to the board of directors, who then reviews the risk register, including any changes in key risks, and provides oversight as appropriate.


text: The Audit Committee and the Technology and Cybersecurity Committee are responsible for oversight relating to cybersecurity. The Board and the Audit Committee regularly receive (and the newly formed Technology and Cybersecurity Committee will receive) presentations and reports on cybersecurity risks from the CISO, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and cybersecurity considerations arising with respect to our peers and vendors. Our incident response process includes escalation of potentially material cybersecurity incidents to relevant members of our executive management team. The Board, the Audit Committee, and the newly formed Technology and Cybersecurity Committee, are updated as appropriate.

companyName: BLACKLINE, INC.

ticker: BL


text: The Company has adopted an Enterprise Risk and Resilience Framework (the "ERRF") to identify, assess, monitor, and control the Company's risks, including cybersecurity risks. Our Chief Risk Officer (the "CRO") is responsible for implementing and executing the ERRF. The Company's information security team is staffed with skilled professionals who manage the safeguarding of our information and is led by our Chief Information Security Officer (the "CISO"). This team is responsible for aligning our practices with the requirements of local regulations and the voluntary standards to which we strive to adhere, such as ISO/IEC 27001 and the Institute of Standards and Technology ("NIST") Cyber Security Framework. The CISO reports directly to our Chief Information Officer (the "CIO") and CRO. The CIO is responsible for designing and executing the Company's technology strategy, which includes overseeing the Company's cybersecurity strategy.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: Cybersecurity for U.S. Government Authorized Systems. With respect to products and services provided to, and information technology systems used in connection with programs for, the U.S. government, our cybersecurity program aligns with the NIST standard and meets the requirements of 32 CFR Part 117 and other applicable U.S. government guidance. The program includes authorization and assessment of new and existing IT systems by our customer. We monitor use on these systems, including vulnerability management through patching and configuration. In addition, we restrict user access and require authorized users to complete additional user and cybersecurity training.

companyName: RTX Corp

ticker: RTX


text: Managing Material Cybersecurity Risks Within Our Overall Risk Management Framework We have strategically and deliberately integrated cybersecurity risk management into our broader risk management framework to promote a Company-wide culture of cybersecurity risk management. This integration seeks to ensure that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management-level Security, Privacy and Compliance Committee (the "SPCC") was established to help ensure that the Company's information security strategy supports our business operations and that the Company complies with applicable laws and regulations with respect to privacy and other cybersecurity matters. The SPCC is also primarily responsible for monitoring and responding to cybersecurity threats as they arise. The SPCC meets quarterly and as necessary. The SPCC is a cross-functional committee, and its members include Company officers and associates involved in various aspects of the Company's governance and operations, including our General Counsel, Corporate Controller, Chief Information Officer, Head of Environmental, Health, Safety and Security and others, and is chaired by our Chief Information Security Officer ("CISO"). In addition, we have established a management-level Cyber Disclosure Escalation Committee (the "CDEC") to assist in the evaluation of cybersecurity incidents that may arise from time to time and the potential need for public disclosure of any such incident. The CDEC meets quarterly and on an ad hoc basis as necessary, and it reports to our CEO and other members of the Company's senior management.

companyName: Integer Holdings Corp

ticker: ITGR


text: o our Chief Privacy Officer; and o our crisis management team, a cross-functional team of senior management and subject matter experts from across the Company established to be ready to respond to crisis events, including those arising from cybersecurity incidents.

companyName: EASTMAN KODAK CO

ticker: KODK


text: • IT managed services that includes help desk support and managed infrastructure (networks and servers support); and • a ransomware defense plan. • cybersecurity awareness training for our employees, including incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • third-party risk management and reporting process for key service providers based on our assessment of their criticality to our operations and respective risk profile, suppliers and vendors with access to our information systems or data.

companyName: Avidity Biosciences, Inc.

ticker: RNAM


text: The Audit Committee and the full Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit Committee performs an annual review of the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation. The Audit Committee's annual review also includes review of recent enhancements to the Company's defenses and management's progress on its cybersecurity strategic roadmap. In addition, the Board receives quarterly cybersecurity reports, which include a review of key performance indicators, test results and related remediation, and recent threats and how the Company is managing those threats. Further, at least annually, the Board receives updates on the Company's Crisis Management Plan, which covers, among other things, potential cybersecurity incidents, data privacy and its compliance programs. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on these topics. For example, in 2024, the Board hosted an expert to discuss developments in the cybersecurity threat landscape and current cybersecurity trends across industries.

companyName: UNITED RENTALS NORTH AMERICA INC


text: In accordance with the aforementioned Policy, Honda has designated its cybersecurity supervisory divisions to conduct risk assessments and report the status of cybersecurity risk responses to the Risk Management Officer through Honda's Risk Management Committee. The designated cybersecurity supervisory divisions consist of members with practical experience in various roles related to information technology, including security, auditing, and systems are established in both the Quality Innovation Operations and Corporate Administration Operations divisions. Honda's Risk Management Officer, who has knowledge and experience in overall risk management, receives technical support from the cybersecurity risk supervisory divisions, and monitors and supervises the responses to risks from cybersecurity threats.

companyName: AMERICAN HONDA FINANCE CORP


text: As a part of the Company's overall risk management and compliance programs, we have developed an enterprise cybersecurity program designed to detect, identify, classify, and mitigate cybersecurity and other data security threats. Our enterprise cybersecurity program classifies potential threats by risk levels and we typically prioritize our threat mitigation efforts based on those risk classifications, while focusing on maintaining the resiliency of our systems. In recent years, we have increased our investments in our ability to detect, identify, classify and mitigate cybersecurity and other data security threats within our environment. In the event we identify a potential cybersecurity or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, the Board, other stakeholders and law enforcement when responding to such issues.

companyName: UNIFI INC

ticker: UFI


text: Our Chief Information Officer and Global Head of Cybersecurity have combined relevant experience of more than 45 years, including over 20 years in cybersecurity, and they oversee our cyber security policies and processes, including those described in "Risk Management and Strategy" above. Our Global Head of Cybersecurity monitors and keeps informed about prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our cybersecurity team, and through the use of technological tools and software and results from third party assessments.

companyName: COHERENT CORP.

ticker: COHR


text: Management's Responsibilities Management is responsible for executing the Cybersecurity Risk Management, Strategy and Governance policies outlined above. This is done, in part, by both establishing systems, processes and controls to minimize the risk of a high severity cybersecurity incident as much as possible, as well as ensuring there is a formal process designed to identify, investigate and appropriately respond to potential cybersecurity incidents. As noted, we have established our ISIRP as a response tool in the event of a cybersecurity incident. The ISIRP documents the actionable steps the SOC team, information security leadership and cross-functional stakeholders and partners take when a cybersecurity incident is identified. The ISIRP covers the preparation, detection and analysis, containment, eradication, recovery and post-incident activities required to effectively respond to an incident.

companyName: Elanco Animal Health Inc

ticker: ELAN


text: Governance and oversight of cybersecurity risks and strategies form a core component of our risk management framework. Recognizing the critical importance of cybersecurity in protecting our operations and preserving shareholder value, we have established a governance structure that emphasizes risk identification, management, and mitigation across our organization.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: We maintain an information security program that includes physical, administrative and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent while timely and effectively responding to cybersecurity threats or incidents. Through our cybersecurity risk management process, which is overseen by the Amplify Information Technology Steering Committee (the "Steering Committee"), we continuously monitor cybersecurity vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of any threat and of cybersecurity risk countermeasures made to defend against such threats. This process has been integrated into the Company's Risk Management Program, and we have integrated Cyber Incident Response planning into our Business Continuity Program. In addition, we routinely engage third-party consultants to assist us in assessing, enhancing, implementing, and monitoring our cybersecurity risk management programs and responding to any incidents. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident. We provide monthly cybersecurity awareness and weekly phishing simulations, data protection modules, tabletop exercises, as well as more contextual and personalized modules for targeted users and roles.

companyName: Amplify Energy Corp.

ticker: AMPY


text: CYBERSECURITY RISK MANAGEMENT Sempra, SDG&E and SoCalGas have cybersecurity risk management processes in place that are intended to protect the confidentiality, integrity, and availability of our critical infrastructure, systems and information. These cybersecurity risk management processes include cybersecurity incident response plans that are integrated into each entity's respective enterprise risk management and emergency management programs.

companyName: SEMPRA

ticker: SREA


text: The cybersecurity team has several other members with expertise in network security, technology, and administration. The cybersecurity team meets regularly to review and assess the Company's cybersecurity posture, identify potential threats, and implement appropriate measures to mitigate risks. The committee also collaborates with external cybersecurity experts to stay informed about the latest threats and best practices in the industry.

companyName: CHOICEONE FINANCIAL SERVICES INC

ticker: COFS


text: We rely on the cybersecurity strategy and policies implemented by HMC Capital, the ultimate parent of our Sponsor. HMC Capital's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. HMC Capital's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. HMC Capital has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: StratCap Digital Infrastructure REIT, Inc.


text: We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. For additional information regarding these risks, please refer to Item 1A, "Risk Factors," "If we, or our partners or suppliers, experience a significant disruption in, or breach in security of, information technology systems, or fail to implement new systems and software successfully, our business could be adversely affected. Cyberattacks and security vulnerabilities could lead to reduced revenue, increased costs, liability claims, or harm to our reputation or competitive position" in this Annual Report on Form 10-K.

companyName: Twist Bioscience Corp

ticker: TWST


text: In the ordinary course of its business, the Bank relies on electronic communications and information systems to conduct its operations and to store sensitive data, and employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding these defensive measures, the threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While the Bank has not, to date, detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, the Bank's systems and those of its customers and third-party service providers are under constant threat and it is possible that we could experience a future significant event. The Bank expects risks and exposures related to cybersecurity attacks to remain high for the foreseeable future. For further discussion of risks related to cybersecurity, see "Item 1A Risk Factors." See also the Company's disclosures regarding risk management, strategy, governance and incident disclosure under Item 1C.

companyName: FARMERS NATIONAL BANC CORP /OH/

ticker: FMNB


text: 9. Regulatory and Legal Compliance Risks The Company is subject to global cybersecurity regulations, including: • SEC cybersecurity disclosure requirements for material incidents and risk management. • Data privacy laws such as CCPA (California Consumer Privacy Act) and GDPR (General Data Protection Regulation). • Automotive cybersecurity standards for protecting connected vehicle systems.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: The operation of our business is dependent on the secure functioning of our computer infrastructure. This infrastructure is used to maintain key processes including management of sensitive company information and operation of sales, record-keeping, and accounting functions.

companyName: RADNOSTIX INC

ticker: INIS


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to monitor, assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operation and respective risk profiles.

companyName: Atea Pharmaceuticals, Inc.

ticker: AVIR


text: Cybersecurity threats are constantly evolving, which drives the evolution of our responses. Typical activities for our information security team include system monitoring, new hire and annual training, testing and evaluation, including "phishing" exercises, and publication of tips and best practices. The results of this testing are communicated company-wide, including to the Technology Committee of the Board of Directors. Our CISO reports to the Technology Committee as requested, but no less than quarterly.

companyName: MAXIMUS, INC.

ticker: MMS


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including through intentional acts or carelessness by employees, customers and other individuals who are authorized to use them, and by criminals, who often use sophisticated and constantly evolving set of software, tools and strategies to do so. The nature of our business, as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue, and any intrusion into our systems could result in material financial losses and operational problems. See "Operational, Strategic and Reputational Risks."

companyName: Midland States Bancorp, Inc.

ticker: MSBI


text: We have operationalized key processes to help us identify, assess, manage, and mitigate reasonably foreseeable risks from potential cybersecurity threats. For example: • USE OF THIRD PARTIES: We engage third-party cybersecurity consulting firms to assist us with various aspects of our cybersecurity risk management program. For example, we currently consult with third party firms to assist with our annual penetration testing for the Tablo device, Tablo cloud and IT infrastructure. In addition, In addition, we used a third-party audit firm accredited by the American Institute of Certified Public Accountants (AICPA) to support us in the SOC 2 certification process for Tablo cloud. • VENDOR ASSESSMENT: We leverage a third-party risk assessment tool to help us identify cybersecurity, privacy, and operational related risks associated with our use of certain third-party service providers. • INCIDENT PREPAREDNESS AND RESPONSE: We maintain a Cybersecurity Incident Response Plan (IRP) which establishes a framework designed to enable us to respond to cybersecurity incidents in a consistent, timely and effective manner. Our IRP outlines procedures for identifying, reporting, investigating, assessing, and responding to cybersecurity incidents, including incident response team formation, roles and responsibilities by department, and communication and escalation protocols. Depending on the severity of the cybersecurity incident, our IRP contemplates escalation to our executive leadership team and the Audit Committee and/or the full Board, as well as periodic briefings on developments related to the incident response. We periodically review and update our IRP and have conducted training of key team members regarding the IRP. In addition, we have conducted a tabletop exercise to simulate a response to a cybersecurity incident. • SECURITY STANDARDS: Our IT and Tablo cloud security architecture are designed to comply with the HIPAA Security Rule. In addition, our Tablo cloud security architecture leverages recognized frameworks designed to protect customer data. For example, we have received SOC 2 certification for Tablo cloud and we are working to align our processes, protocols and product software with the FDA's recent cybersecurity guidance finalized in September 2023. We periodically examine our security controls and take steps to review, prioritize and address key compliance gaps where identified, using a risk-based approach. • TECHNICAL SAFEGUARDS: We perform information security maturity assessments and penetration testing for the Tablo device and Tablo cloud (including in connection with new product features and services), as well as for our IT infrastructure. We conduct vulnerability scans across key assets, core infrastructure, and endpoints to identify potential vulnerabilities and potential cybersecurity events. We assess and prioritize the remediation of vulnerabilities and other cybersecurity risks identified through these activities, using a risk-based approach. • THREAT LANDSCAPE AWARENESS: We regularly receive and review threat landscape bulletins from Health Information Sharing and Analysis Center (H-ISAC), Cybersecurity and Infrastructure Security Agency (CISA) and others, and incorporate enhancements into our ongoing cybersecurity program based on this review. • INSURANCE: We maintain information security risk insurance coverage to mitigate potential losses in the event of a business disruption.

companyName: Outset Medical, Inc.

ticker: OM


text: At STERIS, the enterprise risk management ("ERM") program is designed to identify, assess, and manage risks across STERIS's enterprise. Cybersecurity risk management is integrated into STERIS's ERM program, under which we regularly assess cybersecurity risks in accordance with what we believe are industry cybersecurity best practices. Further, we implement controls to protect the confidentiality, integrity and availability of STERIS's information systems and information. We maintain cybersecurity and incident response procedures to address our security standards and requirements and provide a framework for assessing and responding to cybersecurity threats and incidents. Additionally, as part of our ERM program, STERIS oversees and identifies risks associated with third-party service providers with whom we do business, which process includes due diligence, risk management assessments and contractual safeguards. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cybersecurity issues.

companyName: STERIS plc

ticker: STE


text: Risk Assessments: We evaluate cyber threats such as data breaches, ransomware, and insider threats through threat modeling and business impact analysis. Prioritizing risks based on potential operational disruption ensures timely mitigation of critical threats.

companyName: Armlogi Holding Corp.

ticker: BTOC


text: Our computing environments, products, and services are reviewed by our internal audit teams as well as independent third-party assessors. We are committed to managing the most significant risks to our strategies and ambitions, including cybersecurity risks. The Enterprise Risk Management ("ERM") organization supports management in this commitment by facilitating the semiannual risk assessment, which documents the priority and status of these risks and aligns them with our strategic mitigation efforts. ERM is structured using a framework based on the Committee of Sponsoring Organization ("COSO") guidance on Enterprise Risk Management Integrating Strategy with Performance and it also aligns with the International Organization for Standardization 31000:2018 Risk Management Standard.

companyName: MICROSOFT CORP

ticker: MSFT


text: Incident Response Plan The Integrated Incident Response Program is reviewed at least annually to ensure alignment with any changes in notification laws, company structure and operations, service providers and the risk landscape. The Cyber Incident Response Plan includes materiality assessments in accordance with the new U.S. Securities and Exchange Commission ("SEC") cybersecurity rules. This same process is also used to address materiality as it relates to non-cyber events, should they occur. Tabletop exercises are conducted periodically to assess readiness for plan execution.

companyName: E.W. SCRIPPS Co

ticker: SSP


text: Effects and Impacts of Cybersecurity Risks As of the date of this report, we have not identified any risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. (See Item 1A. Risk Factors).

companyName: Magnera Corp

ticker: MAGN


text: Some of our IT systems and products operate within a hosted architecture or by third-party service providers, and if these third-party IT environments fail to operate properly, our systems and products (including our Nok Smart Entry System) could stop functioning for a period of time, which could put our users at risk. Accordingly, our ability to keep our business operating is highly dependent on the proper and efficient operation of IT service providers, and our vendor management process is an important part of our risk mitigation strategy. In particular, we review Service Organization Controls ("SOC") reports describing vendors' compliance with cybersecurity best practices when they are available or an appropriate subset of those controls for vendors who do not have a SOC report. Notwithstanding, if there is a catastrophic event, such as an adverse weather condition, natural disaster, terrorist attack, security breach, or other extraordinary event, we, and our service providers, may be unable to provide our services and products for the duration of the event and/or a time thereafter.

companyName: Janus International Group, Inc.

ticker: JBI


text: We rely on computer systems and information technology to conduct our business, including to securely transmit data associated with cashless payments. These systems and technology are increasingly complex and vital to our operations, which has resulted in an expansion of our technological presence and corresponding risk exposure. In addition, these systems are inherently vulnerable to disruption or failure, as well as internal and external security breaches, denial of service attacks and other disruptive problems caused by cybersecurity threat actors. We have not experienced any cybersecurity incidents that have materially impacted or are likely to materially impact our business strategy, results of operations or financial condition based on information known to us as of the date of this report. Under the oversight of our Board, our management has developed a cybersecurity risk management program based on the Center for Internet Security Critical Security Controls framework that is integrated with our overall risk management program and is designed to assess, identify, manage and mitigate material cybersecurity risks. Our cybersecurity program includes policies and procedures that govern how security measures and controls are implemented and maintained. We identify and implement security controls to address cybersecurity risks based on an annual risk assessment and our evaluation of relevant factors, including the likelihood of risk, the potential impact and severity of the risk, the feasibility and expense of potential controls, and the impact of controls on our operations. Our cybersecurity program includes regular security assessments and testing, regular employee trainings, third-party security audits, and solutions designed to detect and mitigate cybersecurity threats, including data breaches, malware, ransomware and phishing attacks.

companyName: Natural Grocers by Vitamin Cottage, Inc.

ticker: NGVC


text: Effect of Cybersecurity Events While no previous cybersecurity incidents have materially affected the Company, a cybersecurity incident could have a material effect on our results of operations and financial condition. As described above under "Item 1A-Risk Factors - Technology failures, cybersecurity incidents and corruption of our data privacy protections could disrupt our operations and negatively impact our business," a material cybersecurity incident could disrupt our business, lead to the loss of data or cause us to suffer financial and/or reputational damage, in addition to litigation or remediation costs or penalties.

companyName: BELLRING BRANDS, INC.

ticker: BRBR


text: As of the date of this Annual Report on Form 10-K, though we and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our operations or financial condition. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite implementing our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. While we devote resources to security measures designed to protect our systems and information, no security measure is infallible. See Item 1A. Risk Factors "Risk Factors Relating to Our Business." We depend on computer and telecommunications systems, and failures in our systems or cyber security threats, attacks, or other disruptions could significantly disrupt our business operations." for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.

companyName: SOUTH DAKOTA SOYBEAN PROCESSORS LLC

ticker: SDSYA


text: We also utilize the services of third-party providers to conduct an IT audit, external and internal vulnerability testing, external and internal penetration testing, and social engineering testing on at least an annual basis. The results of these independent audits and tests are sent to the Board of Directors for review.

companyName: QUAINT OAK BANCORP, INC.

ticker: QNTO


text: We have not yet developed a cybersecurity risk management program, though we are in the process of assessing the potential risks. As of this time, we have determined that risks from cybersecurity threats have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: ENCISION INC

ticker: ECIA


text: Aside from more immediate reporting of material incidents to our Board of Directors as described above, our IT personnel regularly provide our Board of Directors an update on cybersecurity during each of its quarterly meetings regarding the effectiveness of technical and human security controls, cybersecurity training program compliance, internal and third-party cybersecurity incidents, and cybersecurity risks.

companyName: Smart Sand, Inc.

ticker: SND


text: We have implemented a cybersecurity program in accordance with our risk profile and business that includes, among other things, written policies, monitoring and filtering procedures, and employee training. We have also developed an incident response policy and procedure designed to facilitate the timely reporting and assessment of cybersecurity incidents.

companyName: X4 Pharmaceuticals, Inc

ticker: XFOR


text: We have an enterprise-wide information security program designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and next-gen detection platforms, security automation orchestration and response, and protection platforms designed to stop initial malicious activity. We also maintain a third-party security program to identify, prioritize, assess, mitigate and remediate third party risks; however, we have a shared responsibility model with these third parties and require them to implement security programs commensurate with their risk. We cannot ensure that in all circumstances their efforts will be successful.

companyName: WideOpenWest, Inc.

ticker: WOW


text: Manage We have implemented a multi-layered defense strategy designed to secure asset access and prevent unauthorized access. We prioritize our defenses based on cost-effectiveness and risk reduction potential, using administrative, procedural, and technical controls.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated responsibility for the periodic review and evaluation of the Company's policies and programs for identifying cybersecurity risks to the Audit Committee. In addition, the entire Board receives quarterly updates on the Company's cybersecurity action plans and annual reports containing full cybersecurity control assessments and action plans from senior management, and periodically reviews information regarding the Company's cybersecurity risks. We have an Information Technology Steering Committee ("ITSC"), comprised of the Company President and Chief Executive Officer, the Executive Vice Presidents of our Vegetation Management and Industrial Equipment Divisions, the Chief Financial Officer, and the Chief Sustainability Officer, that determines the priority of cybersecurity initiatives. The ITSC also reviews the Board's and Audit Committee's feedback and incorporates it into ongoing cybersecurity management efforts.

companyName: ALAMO GROUP INC

ticker: ALG


text: Internal IS Management has the following certifications: Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), GIAC/SANS Certified Forensic Examiner, Cloud Forensics and Incident Responder (GCFR), Certified Advanced Smartphone Forensics (GASF), Certified Cloud Security Professional (CCSP), Magnet Certified Forensic Examiner, BBA Information Technology Emphasis Security, and CompTIA Security+.

companyName: BADGER METER INC

ticker: BMI


text: The full Board has designated the Audit Committee to be responsible for oversight of cybersecurity risk. The Audit Committee receives regular reports from the CIO and the ISD that may discuss topics such as prior assessments, cybersecurity trends, prior cybersecurity events, and planned enhancements. In addition, the Audit Committee also receives regular periodic reports regarding information technology general controls in connection with its oversight of internal control over financial reporting. The Chair of the Audit Committee regularly briefs the full Board on these matters.

companyName: RELIANCE, INC.

ticker: RS


text: Notwithstanding the vigorous approach Matthews takes to cybersecurity, the Company may not always be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on it. Matthews has experienced cyber-attacks in the past and, while none of these cyber-attacks resulted in a material disruption to the Company's business, Matthews may experience additional cyber-attacks in the future. As of the filing of this Form 10-K, the Company is not aware of any such attacks that have occurred since the beginning of fiscal 2025 that have materially affected, or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. While the Company has implemented a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, the Company may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, refer to Item 1A - "Risk Factors - The Company relies on information technology to operate the Company's business. Security breach incidents and breakdowns of information technologies, or failure to comply with laws governing data privacy and data protection, could disrupt the Company's operations, subject the Company to legal claims, and impact the Company's financial results."

companyName: MATTHEWS INTERNATIONAL CORP

ticker: MATW


text: Cyber Risk Exposure Our top cyber risks have been grouped into genericized categories to avoid disclosure of sensitive information but include sufficient detail for a reasonable investor to understand our cyber risks and maintain confidence we act in good faith to reduce our cyber risk exposure. In the fourth quarter of 2023, we performed a risk analysis of all critical assets, determining the following are our current top cyber risks, none of which are material: Compromise to the confidentiality of intellectual property. Compromise to the confidentiality and integrity of financial records. Compromise to the confidentiality of employee records. Compromise to the confidentiality, integrity, and availability of core business systems. Compromise to the confidentiality, integrity, and availability of critical third-party vendors supporting the continuity of business operations.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: Beginning in May 2021, the Department of Homeland Security's (DHS) Transportation Security Administration (TSA) released two directives, with several updates, applicable to certain owners and operators of pipeline facilities, including NW Natural. These directives cumulatively required owners and operators to implement cybersecurity incident reporting to the DHS, designate two cybersecurity coordinators, and perform a gap assessment of current entity cybersecurity practices against certain voluntary TSA security guidelines and report relevant results and proposed mitigation to applicable DHS agencies; implement a significant number of specified cyber security controls and processes; and clarifying Operational Technology (OT) scope and providing a risk- and outcome-based framework. We made significant additional and accelerated investments in cybersecurity in response to the TSA directives.

companyName: Northwest Natural Holding Co

ticker: NWN


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information syst ems or any information residing therein.

companyName: Whitehawk Therapeutics, Inc.

ticker: WHWK


text: The Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected it or are reasonably likely to materially affect it, including its operations, business strategy, results of operations, or financial condition.

companyName: INNOVATIVE SOLUTIONS & SUPPORT INC

ticker: ISSC


text: Our Board of Directors has ultimate oversight of our cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to Company priorities, resource allocations, and oversight structures. The Board of Directors is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors.

companyName: RARE ELEMENT RESOURCES LTD

ticker: REEMF


text: Our Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives briefings from our executive team, informed by our Vice President, Chief Accounting Officer, on our cybersecurity risk management program, on a periodic basis.

companyName: Mersana Therapeutics, Inc.


text: Valkyrie has designated the CCO to implement and maintain the cybersecurity program. The CCO may delegate any of the CCO's responsibilities to appropriate designees as long as the CCO remains primarily responsible for compliance oversight and administration. The CCO will is responsible for: Initial implementation of the cybersecurity program; employee education; testing of the cybersecurity program's safeguards;

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: Material Risks from Cybersecurity Threats We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. For additional information regarding these risks, please refer to Item 1A, "Risk Factors — If we, or our partners or suppliers, experience a significant disruption in, or breach in security of, information technology systems or other cybersecurity incidents, our business could be adversely affected" in this Form 10-K.

companyName: Twist Bioscience Corp

ticker: TWST


text: Risk is monitored and managed through a combination of vulnerability assessments, continuous monitoring, endpoint protection, incident response planning, security awareness training, regulatory compliance monitoring, and threat intelligence.

companyName: SUPERIOR INDUSTRIES INTERNATIONAL INC

ticker: SSUP


text: The Company has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of its critical systems and information. The Company's cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational and financial risk areas.

companyName: ESSEX PORTFOLIO LP


text: We deploy technical safeguards that are designed to protect our information systems, products, operations and sensitive information from cybersecurity threats. These include firewalls, intrusion prevention and detection systems, disaster recovery capabilities, malware and ransomware prevention, access controls, and data protection. We provide periodic training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities and access of the relevant Company personnel. Our policies require all workers to report any real or suspected cybersecurity events.

companyName: BrightSpring Health Services, Inc.

ticker: BTSG


text: Our cyber incident response plan includes third-party cybersecurity incidents and threats. Through our vendor management program, we undertake due diligence of third-party systems with which we will interact and vendors with whom we will interact, including regular reviews and oversight of these service providers through performance and technological reviews and escalation of any unsatisfactory reviews.

companyName: Federal Home Loan Bank of Topeka


text: Cybersecurity Risk Management and Strategy Astrana Health operates in an increasingly interconnected and digitized world, where the protection of sensitive information and the resilience of our information technology systems are paramount to our mission of delivering exceptional healthcare services. Cybersecurity is a critical component of our enterprise risk management program, reflecting our commitment to safeguarding the privacy and security of the patients, employees, and others who entrust us with their data.

companyName: Astrana Health, Inc.

ticker: ASTH


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including Mr. Gharib, who oversees enterprise risk management and information security for the Company.

companyName: SPRUCE BIOSCIENCES, INC.

ticker: SPRB


text: Our executive management team, along with our managed information technology service provider, is responsible for assessing and managing risks from cybersecurity threats to the Company, including our Confidential Information and Critical Systems. The team has primary responsibility for our overall cybersecurity risk management program. Our management team works closely with our information technology service provider.

companyName: Zoned Properties, Inc.

ticker: ZDPY


text: Impact of Cybersecurity Threats Previous cybersecurity incidents have not materially affected us, including our business strategy, results of operations or financial condition. However, risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. See ITEM 1A. "Risk Factors - Increased cybersecurity threats and computer crime pose a risk to our systems, networks, products and services, and we are exposed to potential regulatory, financial and reputational risks relating to the protection of our data" for a discussion of cybersecurity risks.

companyName: PENTAIR plc

ticker: PNR


text: Our business is highly dependent on the processing and storage of significant amounts of data, and we have invested and will continue to invest in measures to secure this data. We have implemented and maintain a comprehensive information security program consisting of policies, procedures, and technology designed to maintain the privacy, security and integrity of our data, intellectual property, confidential information, systems and networks. Our information security program is informed by externally established sets of standards, such as those of the National Institute of Standards and Technology and the Center for Internet Security. Among other things, the program includes controls designed to limit and monitor access to our systems, networks and data, prevent inappropriate or unauthorized access or modification, and monitor for threats or vulnerability. We maintain disaster recovery solutions and implement enhancements as necessary and use technologies that assist in preventing theft and abuse of credentials and sensitive data. We also have third parties perform penetration tests as well as security assessments of mobile applications. Our information security program also includes third-party risk management processes that help us oversee and identify risks from our use of third-party service providers. Additionally, we focus our efforts on education and training for employees regarding cybersecurity and implementing security controls for contractors. We also engage consultants to conduct cybersecurity assessments and preparedness analysis. We primarily conduct our business in the United States and are expanding internationally in various other countries. Conducting expanded international operations subjects us to additional risks, including our exposure to cybersecurity incidents.

companyName: Alarm.com Holdings, Inc.

ticker: ALRM


text: Our management team, including our Global CISO, Chief Operating Officer ("COO"), Chief Information Officer ("CIO"), General Manager of Cloud Infrastructure and ITO, and General Counsel, comprise our Security Steering Committee ("SCC") and are responsible for assessing and managing our material risks from cybersecurity threats. Our Global CISO and our General Manager of Cloud Infrastructure and ITO have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Global CISO has extensive experience assessing and managing cybersecurity-related risks and implementing related policies, procedures, and strategies. Our Global CISO has served in leadership roles related to information security for over 28 years, including serving as a Deputy CISO at another company since 2005, then as its CISO since 2017 and as DXC's Global CISO since May 2019. Similarly, our General Manager of Cloud Infrastructure and ITO is a well-known industry leader with more than 20 years of experience in the technology industry and has been with DXC since 2020.

companyName: DXC Technology Co

ticker: DXC


text: Oversight of Third-party Risks Our third-party service providers, suppliers, vendors, and partners face cybersecurity risks that could impact us. Therefore, the Company has developed and implemented processes to oversee and manage these risks. These processes include performing third-party onboarding due diligence such as risk assessments and information security reviews for critical service providers, suppliers, and vendors, seeking to have third-parties agree to contractual requirements designed to ensure cybersecurity and related matters are addressed, and conducting ongoing monitoring and due diligence in accordance with our vendor management and information security policies and standards. As noted above, we use a third-party to aid us in monitoring third-parties' cybersecurity risk.

companyName: Live Oak Bancshares, Inc.

ticker: LOB


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risks to the Audit Committee. The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, if they should arise, will discuss any material incidents with the Audit Committee.

companyName: Compass Group Diversified Holdings LLC


text: Cybersecurity risk management is integrated with our overall risk management framework overseen by our Enterprise Risk Management Committee – a management level committee, including senior management and other leadership representatives from our operational risk, information security, information technology, legal, operations, and other departments. Our Enterprise Risk Management Committee is responsible for approving policies to support the management and implementation of the cybersecurity program. Our policies establish administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of our information in accordance with Finance Agency regulations and applicable laws. Additionally, the Enterprise Risk Management Committee recommends the annual information technology strategic plan to senior management prior to Board review and approval. This committee receives regular reporting from our chief information security officer similar to what is provided to the Board, and more detailed reporting regarding the availability of information technology assets and cybersecurity threats being monitored.

companyName: Federal Home Loan Bank of Cincinnati


text: Overseeing Third-Party Risk Because we are aware of the risks associated with third-party service providers, we implement processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes regular assessments by our Chief Information Officer. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Stran & Company, Inc.

ticker: SWAG


text: Manage We apply a multi-layered defense strategy to maintain our ability to access or utilize an asset or its value and prevent threat actors from gaining or increasing their access to an asset or its value. We prioritize our defensive mechanisms, including administrative, procedural, and technical controls, based on their cost-effectiveness and their ability to reduce risk.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the Investment Adviser regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Investment Adviser's operations, as well as the Company.

companyName: Commonwealth Credit Partners BDC I, Inc.


text: Nextracker places emphasis on addressing cybersecurity threats and effectively managing associated risks. Our cybersecurity program is designed to identify, assess, and proactively manage material risks.

companyName: Nextpower Inc.

ticker: NXT


text: Third-party Engagement in Connection with our Cybersecurity Program We maintain ongoing engagements with our cybersecurity legal counsel and forensic services firms, each of which has visibility into current events through its client base. We engage throughout the year with not only our security vendors but also H-ISAC, the FBI's InfraGard, and other communities dedicated to sharing information regarding developing cybersecurity threats.

companyName: Encompass Health Corp

ticker: EHC


text: Our Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee, oversees the functioning of our cybersecurity risk management program and ensures strategic alignment and governance of our cybersecurity efforts at the highest level. Our Board of Directors receives periodic briefings on the outcome of our cybersecurity risk management program, including steps that we are taking to mitigate risks that the program identifies, and each quarter, the Audit Committee reviews cybersecurity incidents, metrics, and the state of the program.

companyName: ACCURAY INC

ticker: ARAY


text: The Company's Co-Chief Information Officers, in coordination with the IRT, work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. The Co-Chief Information Officers and the rest of the IRT, in collaboration with the Company's MSP, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the board of managers when appropriate.

companyName: TriLinc Global Impact Fund LLC

ticker: TRLC


text: As part of the above processes, we regularly engage with consultants, auditors, and other third-parties, including reviewing our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.

companyName: HAVERTY FURNITURE COMPANIES INC

ticker: HVT


text: Encryption methods are used to protect sensitive data in transit and at rest. This includes the encryption of customer data, financial information, and other confidential data. We also have a program in place to monitor our retained data by identifying PII and ensuring it is not stored outside of approved locations and systems. We have endeavored to use strong, up-to-date encryption algorithms and to regularly update and patch systems in an effort to guard against vulnerabilities. Similarly, we have sought to manage encryption keys with use of a secure key management system and rotation of keys after use. We have implemented secure protocols, including, e.g., HTTPS for web traffic and SFTP for file transfers.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: Oversight and Governance The Board of Directors has oversight of the Company's cybersecurity program. Our management team, in consultation with the Board of Directors, is responsible for monitoring, preventing, detecting, mitigating and remediating cybersecurity incidents.

companyName: NextPlat Corp

ticker: NXPL


text: The Company has documented cybersecurity policies and standards, assesses risks from cybersecurity threats, and monitors information systems for potential cybersecurity issues. To protect the Company's information systems from cybersecurity threats, the Company uses various security tools supporting protection, detection, and response capabilities. The Company maintains a cybersecurity incident response plan to help ensure a timely, consistent response to actual or attempted cybersecurity incidents impacting the Company.

companyName: JOHNSON & JOHNSON

ticker: JNJ


text: CEO and management are actively engaged in overseeing and reviewing our strategic direction and objectives, taking into account, among other considerations, our risk profile and related exposures, including oversight of risks from cybersecurity threats. As part of this oversight, the Company will update the CEO and Board of Directors periodically, and at least annually, on our cybersecurity program, including with respect to particular cybersecurity threats, cybersecurity incidents, new developments in our risk profile, the status of projects to strengthen our cybersecurity systems, assessments of our cybersecurity program, and the emerging threat landscape.

companyName: Artificial Intelligence Technology Solutions Inc.

ticker: AITX


text: With respect to third-party service providers, our information security program includes conducting due diligence of relevant service providers' information security programs prior to onboarding.

companyName: Renalytix plc

ticker: RNLXY


text: The Company has developed an information security program to address material risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. A risk assessment, based on a method and guidance from a recognized national standards organization, is conducted annually. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: Star Equity Holdings, Inc.

ticker: STRR


text: While material risks are generally overseen by the full Board, the Audit Committee has a key role in cybersecurity risk monitoring and oversight as set forth in its charter. In establishing Audit Committee membership, the Nominating & Corporate Governance Committee identifies directors with relevant IT, network and cyber expertise to serve on the Committee. The CDIO and CISO provide periodic reports to the Audit Committee on the Company's data privacy and information and infrastructure security programs, including cybersecurity risks. In addition, senior management reports to the Board at least annually on cybersecurity risks.

companyName: Frontier Communications Parent, Inc.