text: At least annually, we, with the assistance of an external cybersecurity consultant, conduct a cybersecurity risk assessment that takes into account information from internal personnel, known potential information security vulnerabilities and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, its Nominating and Corporate Governance Committee, and members of management.

companyName: ESSENTIAL PROPERTIES REALTY TRUST, INC.

ticker: EPRT


text: Our Board, in coordination with the Audit Committee, will oversee the Company's enterprise risks arising from cybersecurity threats and will periodically review the measures we have implemented to identify and mitigate data protection and cybersecurity risks.

companyName: BARFRESH FOOD GROUP INC.

ticker: BRFH

secItem: Item 1C


text: We periodically conduct internal audits and are consistently evaluating our cyber readiness. As a result, we have not identified any material cybersecurity risks and are continuously hardening our environment, systems and infrastructure to reduce our vulnerability to attack. Additionally, our program includes regular cybersecurity training for all employees.

companyName: Genprex, Inc.

ticker: GNPX


text: One of the key functions of our Board of Directors is informed oversight of our various processes for managing risk. An overall review of risk is inherent in our Board of Directors ongoing consideration of our long-term strategies, transactions and other matters presented to and discussed by the Board of Directors. This includes a discussion of the likelihood and potential magnitude of various risks, including cybersecurity risks, and any actions management has taken to limit, monitor or control those risks.

companyName: Jet.AI Inc.

ticker: JTAI


text: The Company's cybersecurity program is overseen by our CIO, who is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CIO has over 20 years of global automotive technology and cybersecurity experience and reports to our President and Chief Executive Officer.

companyName: SHYFT GROUP, INC.


text: Material Incidents As of December 31, 2024, we have not experienced any cybersecurity incidents that have materially affected our operations, business strategy, financial condition, or financial results. Our management has assessed known cybersecurity incidents for potential materiality and disclosure using formal documented processes.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: The Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and is composed of members with diverse expertise including, risk management, technology, and finance, allowing them to effectively oversee cybersecurity risks. The Director of Information Technology (DIT) plays a pivotal role in informing the Board on cybersecurity risks. He provides comprehensive briefings to the Board on a quarterly basis which include updates on the results of vulnerability testing, status of software patching installations, results of business continuity exercises, a summary of recent cybersecurity events/articles, and an update on third-party consultant activities. In addition, our external consultants meet with the Board on an annual basis to update them on the results of their reviews.

companyName: HMN FINANCIAL INC


text: Our Company has adopted an Information Security Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process follows the National Institute of Standards and Technology ("NIST") framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation.

companyName: Consensus Cloud Solutions, Inc.

ticker: CCSI


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to us. This cyber risk management program involves risk assessments, the implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. The Adviser actively monitors the current cyber threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks that we face.

companyName: Muzinich BDC, Inc.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address the Company's cybersecurity threats and incidents. These efforts include a wide range of activities, including third-party annual penetration testing, internally managed weekly vulnerability testing and monthly penetration testing, third-party compliance testing and ongoing internal testing and creation and modification of policies and procedures. The results of these assessments are reported at least annually to the Audit Committee and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and ongoing testing.

companyName: VINEBROOK HOMES TRUST, INC.


text: Audits and testing of program effectiveness are coordinated by the Company's Senior Vice President of Audit who oversees the Audit Department and reports to the Audit Committee of the Board of Directors, independent of the technology and cybersecurity functions. The Audit Department utilizes independent third -party audit firms with technology and cybersecurity expertise. Results of all audits and independent assessments are delivered directly to senior management and the Audit Committee of the Board of Directors by the SVP of Audit.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Assets. For example, the risk management and reduction measures we implement for certain of our Information Assets include: policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management, and disaster recovery/business continuity plans; incident detection and response solutions; internal and/or external audits to assess our exposure to cybersecurity threats; documented risk assessments; implementation of certain security standards/certifications; encryption of data; network security controls; data segregation; physical and electronic access controls; physical security; asset management, tracking and disposal; systems monitoring; employee security training; penetration testing; and cyber insurance. In addition to the above, management obtains a third-party review and formal certification of its information management system policies and procedures, which has been collated into an Information Security Management System (ISMS) which is maintained to ISO 27001 standards.

companyName: BICYCLE THERAPEUTICS PLC

ticker: BCYC


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents in the past fiscal year, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information about our cybersecurity related risks, see Part I, Item 1A, Risk Factors under the risks titled "Breaches of our information systems could have a material adverse effect on our business and results of operations" and "If our information technology systems are disrupted, or if we fail to successfully implement, manage and integrate our information technology and reporting systems, our business, results of operations and financial condition could be harmed."

companyName: BIO-RAD LABORATORIES, INC.

ticker: BIO


text: The Company's Chief Information Security Officer (CISO) is responsible for management of material risks from cybersecurity threats. The CISO has multiple years of experience working in information and network security management, and has in-depth knowledge of compliance requirements and standards set by various regulatory agencies. The CISO leads a team dedicated to the prevention, mitigation, detection, and remediation of any cybersecurity incidents. If a potential incident is identified, the CISO is notified and engages the cybersecurity incident response team (CyberSIRT). This team is responsible for declaring a cybersecurity incident and comprises individuals from multiple relevant departments. In the event the CyberSIRT declares an incident, the CISO provides overall direction for the response and mitigation of the threat. This response includes actions taken to protect our data and networks, evaluation of the potential materiality of the incident, and the communication of the incident to critical parties, including senior leadership and the Board of Directors.

companyName: ALASKA AIR GROUP, INC.

ticker: ALK


text: The Company has implemented policies and procedures that are intended to manage and reduce cybersecurity risks. Material risks from cybersecurity threats are managed across HDMC, HDFS, LiveWire and third-party suppliers and vendors. Cybersecurity risks and threats are monitored by the Company's Corporate Information Security Office and routinely discussed with senior management across the Company. Cybersecurity risks are identified and assessed through third-party assessments, IT security assessments, audits conducted by Internal Audit and risk and compliance reviews. Additionally, as part of the Company's cybersecurity risk management process, tabletop exercises are conducted at the technical and management levels. During these tabletop exercises, cybersecurity incidents are simulated, aimed at ensuring the Company is prepared in the event of a cybersecurity incident and to help identify areas of improvement for the cybersecurity program.

companyName: HARLEY-DAVIDSON, INC.

ticker: HOG


text: In 2023, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, operations, or financial condition. However, we cannot eliminate all cybersecurity risks or provide assurances that we have not experienced an undetected. For more information about these risks, refer to the "Risk Factors—Risks Related to Intellectual Property, Data Privacy and Cybersecurity" section in this Annual Report on Form 10-K.

companyName: AssetMark Financial Holdings, Inc.


text: We maintain a comprehensive listing of controls that includes those risk treatments which are continuously monitored and assessed by the Security Operations team. These controls are derived from the risk assessment process and include physical, logical and environmental security, vulnerability management, secure development and change management, fraud detection, and privacy. We also maintain a security awareness program (the "Security Awareness Program"), which is designed, implemented and maintained by our VP of Information Security. Our Security Awareness Program includes training that reinforces our information technology risk and security management policies, standards and practices, as well as the expectation that employees comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect our resources and information, as well as how to respond to unauthorized access to or use of Company information. The Security Awareness Program training is mandatory for all employees at least annually, and it is supplemented by Company-wide assessment initiatives, including periodic testing. Additionally, we provide specialized security training for certain employee roles, such as application developers.

companyName: ASURE SOFTWARE INC

ticker: ASUR


text: The company's board of directors (the "Board" or "Board of Directors") oversees the company's Information Security program, which is approved annually. The audit committee is tasked with oversight of certain risk issues, including cybersecurity, and regularly reports its activities to the Board of Directors. As described in its charter, the audit committee of the Board of Directors oversees risks related to information technology security and regularly reviews and discusses with the VP of Information Security and other members of management the company's information technology security risk exposures, including (a) the potential impact of those exposures on the company's business, financial results, operations and reputation, (b) the steps that management has taken to monitor and mitigate such exposures, (c) the company's information governance policies and programs, and (d) legislative and regulatory developments that could materially impact the company's privacy and data risk exposure.

companyName: FLOWERS FOODS INC

ticker: FLO


text: Since the beginning of the last fiscal year, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, "Risks Related to Kodak's Business and Operations—Cyber-attacks or other data security incidents that disrupt Kodak's operations or result in the breach or other compromise of proprietary of confidential information about our workforce, our customers, or other third parties could disrupt our business, harm our reputation, cause us to lose customers, and expose us to costly regulatory enforcement and litigation, any of which could lead to material adverse effects on Kodak's results of operations, business and financial condition" in this Form 10-K.

companyName: EASTMAN KODAK CO

ticker: KODK


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. In the event of any significant cybersecurity incidents, we will publicly disclose the nature, scope, and impact of the incident, as well as the remediation measures we implement.

companyName: TANCHENG GROUP CO., LTD.

ticker: QSJC


text: Our CTO oversees a dedicated Vice President, Information Security and Privacy, and the CTO's team is primarily responsible to assess and manage our material risks from cybersecurity threats. The CTO oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above.

companyName: Cue Health Inc.


text: We have developed policies, standards, processes, and practices designed to protect our information systems and data from unauthorized access, cybersecurity attacks, and other security incidents. The policies, standards, processes, and practices are implemented and enforced by dedicated IT and cybersecurity professionals. We utilize a variety of control measures and cybersecurity technologies that are designed to protect our availability of critical information systems and data, maintain regulatory compliance, assess, identify, and manage our material risks from cybersecurity threats, and protect against and respond to security incidents.

companyName: MYRIAD GENETICS INC

ticker: MYGN


text: Oversight of Third-Party Service Providers Our third-party risk management program includes processes for identifying and managing material cybersecurity risks arising from third-party providers. Our third-party risk management program actively engages with the enterprise-wide risk assessment process and partners with cyber risk management to report relevant risks to the NCG Committee, the Audit Committee and our internal Enterprise Risk & Compliance Committee. Our third-party risk management program includes cybersecurity as an aspect of its risk assessment of third parties with the objective that key risks are identified and addressed. Moreover, the program also considers risks associated with certain fourth parties, entities that are partners or subcontractors of our direct third-party vendors, through assessments carried out by our third-party service providers.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: Our Security Plan Our Security Plan, developed in collaboration with third-party consultants, aligns with the National Institute of Standards and Technology (NIST) and ISO 27001. This program encompasses security and privacy, risk-based controls, and integrates lessons learned from past cybersecurity incidents. Under the Security Plan, cyber risks, including threats and incidents, are continuously assessed, treated, and monitored. We incorporate insights from incident response and risk mitigation into our cyber risk management strategy to enhance overall cybersecurity. The Security Plan is led by specific management positions selected for their expertise, as detailed below.

companyName: EGAIN Corp

ticker: EGAN


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Our business and operations have been impacted in the past, and may be impacted in the future, in the event of system breach or failure" and "Complying with laws in the U.S., Europe, and other jurisdictions that impose restrictive regulations addressing the collection, use, and other processing of personal information may be expensive, and failure to comply with such laws and regulations could cause substantial harm to our company."

companyName: Amphastar Pharmaceuticals, Inc.

ticker: AMPH


text: The Committee receives reports from the CISO at least twice per year regarding our cybersecurity risk management program and cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding internal and external security reviews, risk assessments, breach preparedness, threat assessments, and cybersecurity incidents it considers to be significant.

companyName: Container Store Group, Inc.


text: We also maintain an Incident Response Plan that sets forth a protocol in the event we are exposed to a cyber-attack or breach. The Incident Response Plan provides a framework for our response, including the appropriate communication and escalation channels.

companyName: XOMA Royalty Corp

ticker: XOMA


text: To foster an enterprise-wide approach to risk management, WEC Energy Group has established an ERSC chaired by its CEO and comprised of a cross-functional group of senior leaders from across WEC Energy Group's organization. The ERSC regularly reviews key risk areas and oversees the development and implementation of effective compliance and risk management practices, including the use of internal and external audits. WEC Energy Group's Board of Directors and the AOC receive reports regarding the same. Governance of WEC Energy Group's cybersecurity risk management program is overseen by the ERSC, along with steering committees for information security, operational technology security, third-party vendor security controls, Sarbanes-Oxley security controls, and North American Electric Reliability Corporation Critical Infrastructure Protection compliance.

companyName: WISCONSIN ELECTRIC POWER CO

ticker: WELPP


text: We employ a number of people who are part of our Information Technology group and are dedicated to and responsible for assessing and managing cybersecurity threats. Our Information Technology Director, who has over 25 years of experience in information security serving in roles of increasing responsibility, works with our cybersecurity employees to set priorities and is responsible for cybersecurity oversight and the escalation of incidents with business impact to senior leadership based on our Information Security Incident Management Policy.

companyName: NEWMARKET CORP

ticker: NEU


text: We face risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have no t had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to our service delivery; however, potential vulnerabilities to known or unknown threats will still remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on our cybersecurity risks.

companyName: AIM ImmunoTech Inc.

ticker: AIM


text: We have not experienced any material cybersecurity breaches or incidents to date, but we cannot guarantee that we will not suffer any such breaches or incidents in the future. We may not be able to detect, prevent, or respond to all cybersecurity risks and threats in a timely or effective manner. We may also incur significant costs and liabilities as a result of any cybersecurity breaches or incidents, such as legal claims, regulatory fines, remediation expenses, reputational damage, loss of business opportunities, or competitive disadvantage. We may also face litigation, investigations, or enforcement actions by governmental authorities, customers, shareholders, or other parties arising from any cybersecurity breaches or incidents.

companyName: Mitesco, Inc.

ticker: MITI


text: Key components of our cybersecurity risk management program include: assessments designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment;

companyName: Plymouth Industrial REIT, Inc.


text: We have defined roles and responsibilities for our assessment and management of risks related to cybersecurity threats, including specific executive-level and management-level positions or committees. Our cybersecurity and privacy program is overseen by our Security and Privacy Program Office ("SPPO"), which is composed of corporate leadership from legal and information technology ("IT"). The SPPO reports to our Head of Information Technology, who is the accountable executive for our cybersecurity program. Our function and business unit executive leadership, acting in support of our SPPO, is responsible for ensuring organizational compliance with data protection safeguard regulations and related risk controls across our organization. Our Head of Information Technology and our Director, Compliance Standards & Data Privacy ("DCSDP"), are responsible for the design, implementation, and monitoring of the cybersecurity and data privacy policies, standards, procedures, and controls that govern our information systems and data processing activities. Our Head of Information Technology has more than 30 years of experience in IT infrastructure, cybersecurity operations, and site reliability engineering for a wide range of software and service organizations, with the last 16 years focused on SaaS software businesses with access to sensitive customer data. The DCSDP also has over 30 years in IT with the last 13 focused on compliance and data privacy issues for Certara.

companyName: Certara, Inc.

ticker: CERT


text: Rubicon employs the use of third-party services to support continuous cybersecurity and network monitoring. Specifically, these third-parties provide managed detection and response, as well as incident response and readiness services. The cybersecurity team manages routine internal auditing, penetration testing, vulnerability scanning, exercising and training, third-party assessments, and policy enforcement. Board of Directors, through the Audit Committee, is responsible for the independent oversight of Rubicon's cybersecurity program.

companyName: Rubicon Technologies, Inc.


text: Risk Management and Strategy have developed and maintained a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats, including by engaging a third-party cybersecurity service provider, which communicates directly with our management and compliance personnel. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors, and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities.

companyName: SurgePays, Inc.

ticker: SURG


text: Cybersecurity and risks associated with information security are operational risks included in the Company's ERM Framework. Cybersecurity risks may also include fraud, harm to employees or customers, violation of privacy or security laws and other legal risks, and reputational risk. These risks are all considered in the Company's ERM Framework as part of the Company's overall risk assessment process. Under the ERM Framework, the Company's Information Security Risk and Compliance departments and all employees are the First Line. Those in the First Line are each responsible for identifying and managing the information security risk associated with their activities. The Company's Enterprise & Operational Risk Management Department is part of the independent risk oversight of information security risk along with the Company's ORMC and ERM Committee, both of which are management risk oversight committees. The Company manages the risk associated with cybersecurity and information security in accordance with our Risk Appetite Statement, as approved by the BOD.

companyName: WESTERN ALLIANCE BANCORPORATION

ticker: WAL


text: We also maintain an information security function that oversees the protection of our information assets through a program informed by standards promoted by the National Institute of Standards and Technology cybersecurity framework and the Cyber Risk Institute's Cyber Profile. These frameworks guide our information security function in designing programs to assess cybersecurity risks and respond to cybersecurity incidents. The information security team is led by a designated Chief Information Security Officer ("CISO") who is responsible for leading enterprise-wide cybersecurity strategy, including assessing and managing risks from cybersecurity threats, and implementing technical security controls by maintaining policies, standards and processes. With more than 20 years of experience in the field of technology and cybersecurity, our CISO has had extensive involvement with the information security function and the maintenance of a robust cybersecurity program. Our CISO has held data privacy and information security roles with increasing responsibility in heavily regulated industries such as financial services, technology and gaming and is a certified information systems security professional.

companyName: ZILLOW GROUP, INC.

ticker: ZG


text: The Board and our executives appreciate the severity of cybersecurity-related risks and support the continuous development of and investment in the information security program.

companyName: FIRST BANCSHARES INC /MS/


text: Our CISO has been with Wyndham since 2012, and has worked in the cybersecurity industry for 19 years. Prior to his time at Wyndham, as a forensic investigator, he performed cyber investigations in both civil and criminal matters and has worked closely with various industries to educate and provide guidance on cybersecurity best practices. The SVP – Legal has been with the Company since 2010, and has served in his current role since 2019. The SVP – Legal leads the legal team responsible for, among other things, corporate secretary matters, SEC reporting, privacy, compliance and legal operations. The SVP – Legal has several years of experience managing risks related to the Company's operations, including data privacy. The IRC also includes our Chief Information and Distribution Officer, Chief Compliance Officer and Chief Financial Officer, each whom has over 15 years of business and senior leadership experience managing risks in their respective fields, collectively covering aspects of cybersecurity, technology strategy, capital allocation and compliance.

companyName: WYNDHAM HOTELS & RESORTS, INC.

ticker: WH


text: Management Oversight and Governance The Company's Chief Information Security Officer ("CISO"), who reports to the Executive Vice President, Software, is responsible for the design and implementation of our security program and strategy based on the mandate provided by the Board and senior management. The CISO has extensive experience in the management of cybersecurity risk management programs, having served in various leadership roles in information technology and information security for over 20 years, including serving as the Chief Security Officer of two other large public technology companies. We believe the Company's business leaders have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.

companyName: FAIR ISAAC CORP

ticker: FICO


text: Governance and Management The Audit Committee assesses cybersecurity risk management as part of its oversight functions. Cybersecurity risk management processes are devised, implemented and assessed quarterly by our Chief Technology Officer. Our Chief Technology Officer has more than 20 years of experience in cybersecurity and information technology, and based on his career, has a deep understanding of our information technology and business needs. Our Chief Technology Officer reports to the Audit Committee quarterly in regard to emerging risks and the overall cybersecurity environment and immediately if and when a cybersecurity incident occurs. Our Chief Technology Officer closely monitors cybersecurity risk, including our practices and procedures against the cybersecurity environment, including the operation of our incident response plan.

companyName: Mondee Holdings, Inc.

ticker: MOND


text: Our board of directors receives periodic reports from management and its designees concerning our significant cybersecurity threats and risks, and the processes we plan to implement and/or have implemented to address them.

companyName: Peraso Inc.

ticker: PRSO


text: Although we develop and maintain systems and controls designed to prevent cybersecurity threats from occurring, and we have a process to identify and mitigate threats, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become increasingly sophisticated. Moreover, despite our efforts, the possibility of these events occurring cannot be eliminated entirely. As we outsource more of our information systems to vendors, engage in more electronic transactions with service providers and relating to patients participating in clinical trials, and rely more on cloud-based information systems, the related security risks will increase and we will need to expend additional resources to protect our technology and information systems. In addition, there can be no assurance that our internal information technology systems or those of our third-party contractors, or our consultants' efforts to implement adequate security and control measures, will be sufficient to protect us against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks which could result in financial, legal, business or reputational harm.

companyName: Lantern Pharma Inc.

ticker: LTRN


text: Annually we conduct an Enterprise Risk Assessment during which we identify and quantify risks, including cybersecurity risks, which could enhance or impede the Company's ability to achieve current or future strategic objectives. The conclusions of the annual Enterprise Risk Assessment are shared with the Audit Committee.

companyName: BrightView Holdings, Inc.

ticker: BV


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cybersecurity threats. Our Chief Information Security Officer ("CISO") is primarily responsible for this cybersecurity program component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to the Risk Committee of our board of directors.

companyName: Third Coast Bancshares, Inc.

ticker: TCBX


text: As part of such reviews, our Board and Audit Committee receive periodic reports and presentations from members of the team responsible for overseeing cybersecurity risk management, including our Chief Information Security Officer (CISO), which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to our peers and third parties. Members of our Management Leadership Team also report to the Board at least annually on data protection and current internal and external developments in cybersecurity, as part of the Board's enterprise risk management review, and the Board receives reports of Audit Committee discussions regarding its oversight of cybersecurity risk. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to the Audit Committee or the Board in a timely manner.

companyName: Mondelez International, Inc.

ticker: MDLZ


text: The Coupang executive leadership team provides oversight and guidance on cyber policies, procedures, and strategies. Our Board of Director's role in risk oversight is consistent with our leadership structure, with the executive leadership team having responsibility for assessing and managing risks we face in executing our business plans, and the Board and its committees providing oversight in connection with those efforts. In addition to the full Board, the Audit Committee of the Board plays an important role in the oversight of our enterprise risk assessment and management activities, which identify key risks to our business, including risks related to cybersecurity, data privacy, and regulations, and assesses any steps taken to monitor and control such risk. The Audit Committee regularly meets with the CISO to discuss various cybersecurity matters including cyber strategy, cybersecurity risks, controls, including results of audits, mitigation strategies, areas of emerging risks, incidents, if any, and industry trends. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported to the Audit Committee through ongoing updates until resolution.

companyName: Coupang, Inc.

ticker: CPNG


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and data. We design and assess our program based on the International Organization for Standardization ("ISO") 27001 framework and other applicable industry standards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use such standards, including ISO 27001, as a guide to help us identify, detect, assess, and manage reasonably foreseeable cybersecurity risks and threats relevant to our business.

companyName: FuboTV Inc.

ticker: FUBO


text: In addition, the Company's information security and/cybersecurity program is managed by our Chief Technology Officer ("CTO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The CTO provides periodic reports to our audit committee as well as our Co-Chief Executive Officers and Chief Financial Officer and other members of our senior management as appropriate. We have also established cross-functional teams to collaborate and communicate on cybersecurity-related issues. The reports to management include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our CTO, Mr. Eliran Ben-Zikri served in the one of the most elite computer units of the Israeli Defense Force and has over 10 years of experience in the cloud technology, previously holding senior positions in leading Israeli technology companies, including eToro and SimilarWeb.

companyName: SKYX Platforms Corp.

ticker: SKYX


text: We incorporate technical safeguards such as Multi-Factor Authentication ("MFA"), principles of Zero Trust and password complexity policies for all accounts to help prevent unauthorized access to our systems and data. We also operate a Security Operations Center ("SOC") to manage our real-time end point protection monitoring.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: Mr. Dennis has served as our Director of Information Technology since June 2019. Mr. Dennis additionally is the founder of a data privacy consulting company and has over 20 years of experience in the data management space. We have implemented a number of processes which allow Mr. Dennis and his team to be informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. These processes include, among other things, system alerts of potential malicious cyber activity, access to real-time dashboards that monitor and assess our systems, status reports provided on a daily, weekly and monthly basis, and regular ongoing communications with service providers regarding potential new attack vectors and vulnerabilities. Mr. Dennis and his team share such information with our management team and reports information about such risks to our Audit Committee.

companyName: Xtant Medical Holdings, Inc.

ticker: XTNT


text: The GIS Program is led by CME Group's Chief Information Security Officer (CISO), who has worked in various roles in information security for over 20 years and has led our GIS Program for more than five years since joining the company in 2016 in a senior role in GIS. The CISO reports to our Chief Information Officer (CIO), a member of our Management Team. Our GIS team is comprised of over 200 full-time employees, many of whom hold cybersecurity, risk, or management certifications, such as Certified Information Systems Security Professional, Certified Information Security Manager, Certified in Risk and Information Systems Control, Series 99, Certified Information Systems Auditor, Project Management Professional, various cloud provider certifications and various levels of ITIL certifications. As part of our GIS Program, CME Group operates a Cyber Defense Center that virtually links 24/7 to our international cybersecurity teams and serves as a global hub for cybersecurity risk management activities, including log collection, event monitoring, threat detection and incident response, resiliency, operations, vulnerability management and the proactive collection and processing of both open source and proprietary threat and intelligence feeds allowing the company to efficiently manage, investigate and respond to cybersecurity events. Our GIS team conducts analyses and aims to prevent, detect and respond to systemic events that might threaten our company, industry or the economy.

companyName: CME GROUP INC.

ticker: CME


text: We have implemented incident response processes that focus on preparation for a cybersecurity incident; detection and analysis of a security incident; containment, eradication, and recovery; and post-incident analysis. Our program is designed to evaluate, rank by severity and prioritize response and remediation of security events and data incidents. Incidents are evaluated to determine operational and business impact, as well as privacy considerations. We also conduct tabletop exercises to simulate responses to cybersecurity incidents and evaluate the effectiveness of our incident response systems. Our team of cybersecurity professionals then collaborates with technical and business stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation, and remediation strategies. We maintain controls and procedures that are designed to promote prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Audit Committee of our Board in a timely manner.

companyName: Jamf Holding Corp.

ticker: JAMF


text: Our management team, led by our CFO, is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity risks and incidents through updates by our Director of IT. This management team is responsible for assessing and managing risks that may arise from cybersecurity threats. Our CFO has over 10 years of experience managing IT operations including strategy, infrastructure and execution. Our Director of IT has over 20 years of experience in information technology including roles managing operations, compliance, development, applications, information security, support and execution.

companyName: ESCALADE INC

ticker: ESCA


text: A monitoring and detection system has been implemented to help identify cybersecurity incidents. Our network activity, logs, and system behavior are monitored for anomalous or unauthorized activity using threat detection technologies. In addition, we have a cross-functional incident response plan, which includes an executive management team, established incident levels, and associated notification procedures, including escalation procedures upon discovery of material cybersecurity risks. We assess and update our security procedures and controls in an effort to address evolving threats and comply with applicable laws and regulations. We perform cybersecurity tabletop exercises to test the effectiveness of our incident response plan and implement post-incident "lessons learned" to enhance our response.

companyName: TETRA TECHNOLOGIES INC

ticker: TTI


text: The Company's Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board of Directors is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and procedures are fully integrated into the Company's information technology practices and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Kontoor Brands, Inc.

ticker: KTB


text: In the event of a cybersecurity incident, our Chief Information Security Officer and our Security Team are equipped with a well-defined incident response plan to guide response actions. This incident response plan includes immediate actions to mitigate the impact of the incident, long-term strategies for remediation and prevention of future incidents, and provides for internal notification of the incident to functional areas, as well as senior leadership and the Cyber Risk and/or Audit Committees of our board of directors, as appropriate.

companyName: RAMBUS INC

ticker: RMBS


text: Our CISO reports directly to our Executive Vice President and Chief Information Officer ("CIO"), who reports to our CEO. Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication with and reporting from the enterprise security team, many of whom hold cybersecurity certifications, and through the use of technological tools and software and results from third-party assessments. Our CISO and CIO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CISO has 25 years of cybersecurity experience, including having served as Chief Technology Officer/CISO and co-founder of two cybersecurity companies, during which time he provided cybersecurity consulting services to Fortune 500 companies and taught digital and network forensics course at the National Computer Forensics Institute. Prior to joining our company, our CISO served as the Director of Security Services for a large network infrastructure company and our CIO was responsible for network security policies, technology, and operations, including intrusion detection systems and conduct penetration testing, at another large public company. The CIO (and previously, Vice President, Audit and Security) periodically reports to the Audit Committee regarding cybersecurity risk exposure and risk mitigation strategies. The board of directors also may review and assess cybersecurity risks in connection with its review of our company's mission critical risks.

companyName: CROWN CASTLE INC.

ticker: CCI


text: We are constantly evolving our cyber defenses to minimize impacts from cyber threats by using a multi-pronged approach that helps safeguard our assets and data. We are particularly focused on addressing emerging cybersecurity risks, including human risk, as phishing attacks remain one of the most common causes of data breaches; third-party supply chain risks, as threat actors continue to target supply chains to compromise a greater number of victims; and geopolitical risk, as tensions and conflicts around the world are often accompanied by an increase in sabotage, espionage and cyber attacks. As threat actors frequently target employees to gain access to information and systems, we have a comprehensive global human risk management program that educates our workforce on threats they face as a first line of defense, and includes elements addressing phishing, malware, data handling, device security, cybersecurity education, password security, internet browsing and defenses to physical threats. Our employees are exposed to data-driven cybersecurity awareness campaigns and annual training in order to keep pace with industry standards, evolving challenges and innovative solutions with respect to information security, data privacy, and cybersecurity risks to the organization. In many regions, our employees receive a monthly snapshot of their cyber behaviors and are given a rating for their cyber vigilance. Additionally, we employ a multi-layered approach in our application of cybersecurity technologies to help safeguard our systems, networks, and data from potential cybersecurity threats. For companies that we acquire, our integration plans include, where appropriate, workable timelines for alignment on information security, data privacy, cybersecurity and employee education.

companyName: BRISTOL MYERS SQUIBB CO

ticker: BMY


text: While we believe our approach to cybersecurity is reasonable, given the rapidly evolving nature of cybersecurity incidents, there can be no assurance that the controls we have designed and implemented will be sufficient in preventing future incidents or attacks. To date, no cybersecurity incident or issue has had a material impact on us. See "Item 1A –Risk Factors – Our business could be negatively affected by cybersecurity incidents and other technology disruptions" for more information about cybersecurity risk.

companyName: Weatherford International plc

ticker: WFRD


text: Franklin Templeton has relationships with a number of third party service providers to assist with cybersecurity containment and remediation efforts, including a forensic investigation firm, a ransomware recovery vendor, a communications firm, and various law firms.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We invest in cybersecurity to protect intellectual property, customer data, manage reputational risk, and maintain business continuity across our devices, applications, and corporate networks. We strive to ensure ongoing compliance with the requirements under relevant standards including the Payment Card Industry Data Security Standards and relevant data privacy and protection laws and regulations. Additionally, our teams reference the standards, guidelines, and practices from the NIST Cybersecurity Framework (CSF) to align our cybersecurity program and risk management practices.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: At the management level, the CISO leads the ongoing technical and business functions that include cybersecurity, information assurance, network security, systems engineering, and information security management. A dedicated information security division reports to the CISO. The CISO has over 30 years of experience in information security including physical, cyber, IT, disaster recovery, business continuity planning, secure software development, and cloud services and security, among others. The CISO holds multiple designations from the International Information System Security Certification Consortium, including Certified Information Systems Security Professional and has been a member of various boards including IT, Cybersecurity and Enterprise Risk Committees. Organizationally, the CISO reports to the CRO and provides reporting directly to the Risk Committee of the Board of Directors.

companyName: BankUnited, Inc.

ticker: BKU


text: The Company also appointed a certified Chief Information Security Officer ("CISO") with significant public and private cybersecurity experience. The CISO is dedicated to assessing the Company's data security risk, monitoring cyber threat intelligence and taking the steps necessary to implement pertinent safeguards and protocols to manage the risk. In addition, the Executive Risk Committee ("ERC"), referenced above in ITEM 1 "Business" - Enterprise Risk Management, annually reviews the Company's cyber exposure across all lines of business and security safeguards for privacy-protected data held by the Company. The ERC, through its sub-committees, including the Operational Risk Committee and the Global IT and Cyber Risk Management Committee, works in conjunction with the Company's CISO to assess the Company's vulnerabilities to cybersecurity threats, including the operational risk of such threats to our business, as continuous dialogue throughout the year is essential in assessing the operational risk to our business of cybersecurity threats. The Operational Risk Committee and the Global IT and Cyber Risk Management Committee sub-committees meet quarterly in advance of the quarterly ERC meetings to, among other things, report on material cybersecurity risks.

companyName: EVEREST REINSURANCE HOLDINGS INC


text: Dow has established cybersecurity and information security awareness training programs. Formal training on topics relating to Dow's cybersecurity, data privacy and information security policies and procedures is mandatory at least annually for all employees, contractors and third parties with access to Dow's network. Training is administered and tracked through online learning modules. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues. Based on role and location, some employees receive additional in-depth training to provide more comprehensive knowledge on potential risks related to their individual job responsibilities. Training is supplemented through regular Dow company-wide communications with frequent updates to educate on the latest adversary trends and social engineering techniques.

companyName: UNION CARBIDE CORP /NEW/


text: We have not identified any risks from cybersecurity threats including those ones resulted from previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Lazydays Holdings, Inc.

ticker: GORV


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced cybersecurity incidents. For information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K, including the risk factor entitled "Security breaches, improper access to or disclosure of our data or user data, other hacking and phishing attacks on our systems, or other cyber incidents could harm our reputation and adversely affect our business."

companyName: AppLovin Corp

ticker: APP


text: There have been cyberattacks and other physical attacks within the energy industry on energy infrastructure such as substations, gas pipelines and related assets in the past and there may be such attacks in the future. Although there have been no cybersecurity incidents or threats with a material impact on NEE's nor NEP's business strategy, results of operations, or financial condition, NEE's information technology systems could fail or be breached, and such systems could be inoperable, causing NEE and NEP to be unable to fulfill critical business operations. The disclosures herein should be reviewed with the risk factors included in Item 1A.

companyName: XPLR Infrastructure, LP

ticker: XIFR


text: Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.

companyName: AZEK Co Inc.


text: The Company has an enterprise risk management ("ERM") program that includes the processes used to identify assess, and manage our most significant enterprise risks and uncertainties that could materially impact the long-term health of the Company or prevent the achievement of strategic objectives. These risks are identified, measured, monitored, and managed across key risk categories, which include the consideration of cybersecurity risks. The Company develops and maintains cybersecurity processes that protect the confidentiality, integrity and availability of Company, employee, customer and partner information against a growing number of cybersecurity threats and threat actors. Our cybersecurity program is designed to protect our infrastructure from potential threats, including threats associated with our third party business partners, to allow us to assess, identify and manage material risks from cybersecurity threats and to endeavor to secure the integrity of our data and IT systems using techniques, hardware, and software typical of companies of our size and scope, which are described further below. For example, we leverage the National Institute of Standards and Technology Cybersecurity Framework's ("NIST CSF") principles in developing our cybersecurity program to monitor our security environment and manage risk. However, this does not mean that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks and threats relevant to our business.

companyName: Sotera Health Co

ticker: SHC


text: To our knowledge, no cybersecurity incidents or threats have resulted in a reportable event, and have not materially impacted Nicolet's operations or financial condition. For additional discussion of cybersecurity risks, see Item 1A, "Risk Factors – Operational Risks."

companyName: NICOLET BANKSHARES INC

ticker: NIC


text: Tilray is dedicated to maintaining a robust cybersecurity program to safeguard our assets, data, and stakeholders' interests. We remain vigilant in our efforts to identify, assess, and mitigate cybersecurity risks and are committed to transparency and accountability in our cybersecurity disclosures.

companyName: Tilray Brands, Inc.

ticker: TLRY


text: Program Assessments Our cybersecurity processes are evaluated as part of an ongoing assessment of our internal control environment, which are informed by the five pillars of the NIST Cybersecurity Framework ("NIST CSF"). We employ a third-party service provider to conduct periodic penetration tests and scan different parts of our IT environment for potential vulnerabilities. We prioritize critical or high vulnerabilities for swift remediation. Additionally, we employ a third-party service provider for continuous cybersecurity risk and vulnerability monitoring. We make continuous adjustments to system and network configurations to mitigate or remediate identified vulnerabilities.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: We maintain an information security and cybersecurity program and a cybersecurity governance framework that are designed to protect our information systems against operational risks related to cybersecurity.

companyName: AMERICAN EXPRESS CO

ticker: AXP


text: Our Board of Directors has delegated to the Audit Committee the responsibility for reviewing our processes and policies with respect to risk assessment, risk management and risk acceptance, including our processes and policies with respect to information security and cybersecurity. The Audit Committee receives quarterly reports from the CTO and senior members of the information security team, which include information on cybersecurity incidents and related remediation efforts, the broader information security and cybersecurity threat landscape, the information security program's strategic priorities and progress made in respect of those priorities. Our Chief Audit Executive reports to the Audit Committee with respect to our key risks, including information security and cybersecurity risks, which are monitored pursuant to our SRM program.

companyName: Paramount Global


text: Cybersecurity Program Overview FS Investments has instituted a cybersecurity program designed to identify, assess and manage cybersecurity risks applicable to us. The cybersecurity risk management program involves, among other things, risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. FS Investments actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by us.

companyName: FS Specialty Lending Fund

ticker: FSEN


text: Potential information security incidents are identified in a number of ways, including, but not limited to: users reporting security violations, system weaknesses, violations of our Acceptable Use Policy which addresses the boundaries of acceptable use of our information technology assets, automated system alerts, and monitoring of both system generated and manually generated logs. Our Information Security Program mandates that any potential information security incident be reported to a member's direct supervisor, IT Management, or the Information Security Officer, to initiate the internal communication and investigation stage, during which such events undergo initial investigation for validation, including related to the scope and depth of such incident and to ensure that it has not resulted from a false positive. Internal communications regarding the potential incident are led by the Information Security Officer and the Incident Response Team ("IRT") in accordance with the CIRP.

companyName: Community West Bancshares

ticker: CWBC


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity, including data security risk mitigation efforts, to the Audit Committee. Under the Audit Committee charter, the Audit Committee has responsibility for discussing with management the Company's policies with respect to risk assessment and risk management, including guidelines and policies to govern the process by which the Company's exposure to risk is handled.

companyName: STAAR SURGICAL CO

ticker: STAA


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. The Company has designed and implemented a cybersecurity incident response plan and related processes, which is overseen by an internal information technology specialist. Cybersecurity threats are identified and escalated to a member of management pursuant to criteria set forth in these processes.

companyName: Sow Good Inc.

ticker: SOWG


text: As part of our overall risk management program, we monitor and test our safeguards and train our employees on the importance of these safeguards. We maintain a formal information security awareness training program for all employees that includes training on matters such as phishing, email security best practices and data protection. Employees also receive random phishing tests at regular intervals to further assess and mitigate overall risk.

companyName: Arq, Inc.

ticker: ARQ


text: a security team principally responsible for managing: (1) our cybersecurity risk assessment processes, (2) our cybersecurity controls and processes, and (3) our response to cybersecurity incidents;

companyName: Walker & Dunlop, Inc.

ticker: WD


text: In addition, in accordance with Gramm-Leach-Bliley Act requirements regarding safeguarding and protecting customer information, an Information Security Risk Assessment is conducted at least annually by the Risk Department and reviewed with the Management Risk Committee, the ERM Committee, and the Board of Directors. A risk analysis is performed to evaluate current processes, identify information assets, and determine the adequacy of the safeguarding and protection of confidential customer information collected and maintained. For each information asset identified, the criticality of the asset, the threats to the defined asset, the likelihood of compromise of the asset, the business impact if an asset is compromised, and an overall risk rating for each asset are defined. The results of this assessment are reviewed with the Information Systems (IS) Steering Committee and the Risk Committee and reported at least annually to the Board ERM Committee.

companyName: FARMERS & MERCHANTS BANCORP INC

ticker: FMAO


text: We have not identified known risks, including as a result of prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. See Item 1A Risk Factors - Cybersecurity risks and cyber incidents could adversely affect our business and disrupt operations.

companyName: ASCENT INDUSTRIES CO.

ticker: ACNT


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. The structure of our information security program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and other industry standards. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Cricut, Inc.

ticker: CRCT


text: Our strategy is based around identification, mitigation, avoidance and response to material cybersecurity risks. We employ physical and electronic safeguards to control access to our systems. We employ additional electronic safeguards to control/limit access to the data contained in those systems. We review and re-assess these processes on a rolling basis with the assistance of both internal staff and outside vendors, including assessors, consultants, auditors, and other third parties. Some steps we take include the use of standard security protocols such as password maintenance, multi-factor identification, and penetration testing. We take other steps as may be situationally appropriate for the specific risk presented.

companyName: FONAR CORP

ticker: FONR


text: The Company evaluates our third-party vendors and service providers to ensure appropriate oversight and to identify any risks from cybersecurity threats associated with the use of their tools or services. To that end, as part of the onboarding process, our internal IT Security Operations team: • Collects and evaluates self-certification information about each vendor's cybersecurity program and external certifications; • Reviews independent security reports that inform us about each vendor's security posture and historical incidents; and • Provides a timely evaluation of whether to move forward with the vendor's engagement based on their cybersecurity risk profile.

companyName: SEMTECH CORP

ticker: SMTC


text: The Company's Chief Financial Officer, or CFO, Information Technology, or IT, manager, legal function and external information technology and cybersecurity service provider help to identify, assess and manage our cybersecurity threats and risks. They identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our and our industry's risk profile using various methods, including, for example, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating threats reported to us, conducting internal audits, and conducting internal and external threat and vulnerability assessments.

companyName: Kezar Life Sciences, Inc.

ticker: KZR


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face material cybersecurity threats. However, we do depend on the digital technologies of third parties, including information systems, infrastructure and cloud applications and services, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data.

companyName: ASPAC I Acquisition Corp.


text: We utilize a risk-based approach that aligns with the National Institute of Standards and Technology Cybersecurity Framework, and Microsoft best practices. Our policies and procedures are reviewed and updated annually by the Cyber Steering Committee and incorporate third-party assessments to benchmark ourselves against industry standards. The Company utilizes advanced endpoint protection, firewalls, intrusion detection and prevention, threat intelligence, security event logging and correlation, and backup and redundancy systems.

companyName: Urban Edge Properties

ticker: UE


text: Additionally, the CIO presents a quarterly cyber update to the board of directors of our GP for an overview of cyber program key metrics and trends, cyber event executive summaries (based upon occurrence), fiscal year security goals and tracking progression, risk register scoring, and status updates on cyber related projects.

companyName: NGL Energy Partners LP

ticker: NGL


text: The CDO and CISO annually brief our full Board of Directors on enterprise-wide cybersecurity risk management and our overall cybersecurity risk environment.

companyName: DOVER Corp

ticker: DOV


text: 3. Intellectual Property Theft: Unauthorized access to our proprietary information could result in intellectual property theft, which would impact our competitive position in the market.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: As noted above, our Chief Risk Officer, Chief Information Security Officer, and cybersecurity team provide regular reports to the Board regarding cybersecurity risks, as well as a review of the processes described above. In particular, our Chief Risk Officer provides reports at every regularly scheduled Board meeting regarding our most material risks and the degree of exposure to these risks. Our management personnel are also required to provide more frequent updates to the Enterprise Risk Committee on major developments regarding cybersecurity matters. The Committee, in turn, provides regular updates to the Board on these matters.

companyName: INDEPENDENT BANK CORP /MI/

ticker: IBCP


text: We, like any technology company operating in the current environment, have previously experienced cybersecurity incidents. However, as of the date of this Annual Report on Form 10-K, we do not believe that any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, are reasonably likely to have a material effect on us, our business strategy, results of operations, or financial condition. For additional information regarding risks related to cybersecurity threats, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factor entitled "Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized disclosure of data, or theft or tampering of intellectual property, and give rise to potential harm to customers, remediation and other expenses under a variety of domestic and international laws or other laws or common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business and operations."

companyName: BlackSky Technology Inc.

ticker: BKSY


text: We have engaged third-party providers to periodically assess certain of our internal controls and procedures for information security. We have also taken certain measures to mitigate cybersecurity risks, including, for example, cybersecurity awareness training for employees and management, periodic testing through simulated "phishing" campaigns (and require remedial training based on results) and the adoption of an incident response plan, vulnerability management policy and business recovery plan.

companyName: Arcus Biosciences, Inc.

ticker: RCUS


text: The Company relies extensively on various information systems and other electronic resources to operate its business. In addition, nearly all of the Company's customers, service providers and other business partners on whom the Company depends, including the providers of the Company's online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including by employees, customers and other individuals who are authorized to use them, and bad actors using sophisticated and constantly evolving set of software, tools and strategies to do so.

companyName: LANDMARK BANCORP INC

ticker: LARK


text: Cybersecurity risk management is an important part of our overall risk management efforts. Okta, Inc., like other companies, is subject to a wide variety of cybersecurity attacks on its systems, networks and data on an ongoing basis and with increasing sophistication. Given the evolving cybersecurity threat landscape facing us and our third-party service providers, we remain committed to protecting our systems, internal networks and our customers' systems, and the information that we and they store and process.

companyName: Okta, Inc.

ticker: OKTA


text: As previously disclosed, in April 2022, we experienced a cybersecurity incident that disrupted a subset of our hospital operations and involved the exfiltration of certain confidential company and patient information. We incurred significant costs to remediate the issues, sustained lost revenues from the associated business interruption and incurred other related expenses. Following this incident, we implemented certain changes to our information systems and processes meant to provide additional protections to our environment, including enhancements to our Security Operations Center, system backups, training practices, detection tools and capabilities, and implementation of new tools and processes, among others. However, we continue to face a heightened risk of cybersecurity threats targeting healthcare providers, including ransomware attacks, which may materially impact our business, financial condition or results of operations. Additional information on cybersecurity related risks is included in Item 1A, Risk Factors, of Part I of this report.

companyName: TENET HEALTHCARE CORP

ticker: THC


text: The Trust does not have a board of directors, so the Trustee is responsible for oversight of the Trust’s risks from cybersecurity threats. The Trustee has dedicated personnel that are responsible for assessing and managing the Trust’s cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee’s information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. External partners are a key part of the Trustee’s cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.

companyName: PermRock Royalty Trust

ticker: PRT


text: We have implemented and maintain a cybersecurity risk management program that is designed to identify, assess, and manage material risks from cybersecurity threats to our critical systems and information. Our cybersecurity risk management program is integrated with our overall enterprise risk management program and includes the following key elements: • We perform risk assessments designed to help identify material cybersecurity risks to our critical systems and services, and where appropriate, we engage external experts and consultants to assist us in performing certain of these risk assessments; • Our cybersecurity team is composed of security and infrastructure engineers and compliance personnel. This team is principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our responses to cybersecurity incidents; • We use external cybersecurity service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security processes; • We conduct periodic cybersecurity awareness trainings for employees who have access to our IT systems; • We maintain a cybersecurity incident response plan and a security operations function so we can respond to cybersecurity incidents and comply with legal and disclosure obligations; and • We have implemented a third-party risk management process for key third-party service providers. This includes, among other things, conducting security assessments of key third-party service providers, including prospective third-party service providers, prior to entering into or renewing business transactions with them or providing them access to our data or information systems and imposing contractual restrictions on such providers as appropriate based on their risk profile.

companyName: Maplebear Inc.

ticker: CART


text: The Company also holds an annual cybersecurity educational session and updates both the Audit Committee and the Digital Product and Technology Committee, which oversees the Company's digital product and services and technology strategies, initiatives and investments. The annual session is dedicated to the Enterprise Security Compliance and Data Protection program, which features perspectives on the status of Wiley's Cybersecurity Program, including related policies, procedures and practices and emerging trends in the cybersecurity space from the Company's CISO complemented by an outside expert.

companyName: JOHN WILEY & SONS, INC.

ticker: WLY


text: With respect to cybersecurity risks and threats, we utilize various third-party consultants and advisors to assist us with regular reviews, internal audits and best practices, including threat prevention and detection, security reviews and enhancements, penetration testing and full scope IT audits. CytoSorbents also has strict processes in place for the review of third-party service providers engaged, including thorough security assessments before engagement and annual monitoring of their IT environments and controls.

companyName: Cytosorbents Corp

ticker: CTSO


text: iii. Incident Response and Recovery - The Company's formal Incident Response and Business Continuity Programs establish a clear, consistent, standard, and organized process by which cybersecurity incidents will be promptly responded to by the Company's incident response teams.

companyName: CENTRAL PACIFIC FINANCIAL CORP

ticker: CPF


text: Management's Role Managing Risk Matthews' CIO and CISO are primarily responsible for assessing and managing cybersecurity risks. The CIO reports directly to the Company's Chief Financial Officer, and the CISO reports to the CIO. The CIO, CISO, and the Company's cybersecurity team have decades of experience in various roles managing information security, developing cybersecurity strategy and implementing, planning and operationalizing a comprehensive global IT infrastructure. In addition, the Company's legal team dedicates full-time internal resources to support the CISO in assessing and addressing compliance issues related to the various data protection and data privacy considerations arising from regulations, statutes and laws in the jurisdictions the Company operates.

companyName: MATTHEWS INTERNATIONAL CORP

ticker: MATW


text: HVII depends on digital technologies, including information systems, infrastructure and cloud applications and services, including those of third parties with which it may deal. Sophisticated and deliberate attacks on, or security breaches in, its information systems or infrastructure, or the information systems or infrastructure of third parties or the cloud, could lead to corruption or misappropriation of its assets, proprietary information and sensitive or confidential data. Because of its reliance on the technologies of third parties, HVII also depends upon the personnel and the processes of third parties to protect against cybersecurity threats. In the event of a cybersecurity incident impacting HVII, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with the cybersecurity incident. As an early-stage company without significant investments in data security protection, there can be no assurance that HVII will have sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have adverse consequences on its business and lead to financial loss.

companyName: Hennessy Capital Investment Corp. VII

ticker: HVII


text: We often engage with specialized third-party assessors, consultants, auditors, and other experts to review, validate, and enhance our cybersecurity practices. Their independent assessments provide an external perspective on our cybersecurity posture, allowing us to leverage best practices from the industry and ensure our defenses remain robust. All third parties engaged for such processes are subjected to rigorous scrutiny to ensure they meet our security standards.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB


text: The Fund has processes in place to assess, identify, and manage material and immaterial risks from cybersecurity threats. The Fund's business is dependent on the communications and information systems of the Investment Adviser and other third-party service providers. The Investment Adviser manages the Fund's day-to-day operations and has implemented a cybersecurity program that applies to the Fund and its operations. To that end, the Investment Adviser has provided training to its employees, independent contractors and the Trustees of the Fund about its cybersecurity risk management program. The Fund's Trustees have been charged with oversight of the program and will be informed about any data incident and how it is being handled, including any regulatory reporting implications.

companyName: Wellings Real Estate Income Fund


text: Index to Financial Statements We have integrated aspects of our cybersecurity risk management processes into our overall risk management program through, for example, common methodologies, reporting channels and governance processes that apply across the overall risk management program to other risk areas.

companyName: DIGITAL REALTY TRUST, INC.

ticker: DLR


text: Cybersecurity risk is the risk of compromising the confidentiality, integrity, or availability of our technology platforms, data, and other systems, which could have an adverse impact on us, our members, Clients, and Network Partners. We take a strategic, risk-based approach to our cybersecurity program, which emphasizes continual improvement in an effort to protect and enable our business operations. Our enterprise cybersecurity program is designed to assess, identify, and manage cybersecurity threats through continuous monitoring of our information systems for potential vulnerabilities and through various controls and security tools designed to prevent, detect, escalate, investigate, resolve, and recover from identified and reasonably anticipated vulnerabilities, including any cybersecurity incidents, in a timely manner.

companyName: HEALTHEQUITY, INC.

ticker: HQY


text: Our Board, in coordination with the Audit and Risk Committee, oversees the Company's Enterprise Risk Management process, including the management of risks arising from cybersecurity threats. Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit and Risk Committee. Both the Board and the Audit and Risk Committee periodically review the measures we have implemented to identify and mitigate cybersecurity risks.

companyName: AUTOLIV INC

ticker: ALV


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to follow our industry's best practices and provides a framework for identifying, monitoring, assessing, and responding to cybersecurity threats and incidents, including threats and incidents associated with the use of third-party vendors and service providers, and facilitating coordination across the Company. This framework includes steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider, assessing the severity and risk of a cybersecurity threat or incident, implementing cybersecurity countermeasures and mitigation strategies, evaluating any related disclosure obligations, and informing management, our audit and risk committee, and our board of directors of potentially material cybersecurity threats and incidents or other significant changes in the evolving cybersecurity threat landscape.

companyName: Remitly Global, Inc.

ticker: RELY


text: Our Chief Financial Officer plays a pivotal role in informing the Board of Directors on cybersecurity risks and provides briefings to the Board of Directors on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.

companyName: First Choice Healthcare Solutions, Inc.

ticker: FCHS


text: Board of Directors The Audit Committee of our Board (the "Audit Committee") oversees, among other things, the controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in our disclosure controls and procedures. Further, our Chief Financial Officer and our VP of Technology report on cybersecurity matters, including material risks and threats, to the Audit Committee, and the Audit Committee provides updates to our Board, in each case as frequently as is appropriate.

companyName: Mobile Infrastructure Corp

ticker: BEEP


text: We rely upon multiple information technology systems and networks, some of which are web-based or managed by third parties, to process, transmit, and store electronic information and to manage or support a variety of critical business processes and activities. We actively review the risks associated with all third-party service providers at the inception of our relationship with them and on an ongoing basis as part of our information security program and enterprise risk management third-party risk assessment process. These processes include architecture reviews and contractual clauses related to data protection and compliance, SSAE audits and reviews of vendor System and Organization Controls ("SOC") 1 and SOC 2 Type II reports for critical vendors and ongoing monitoring and reporting of vendor security by independent third parties.

companyName: KELLY SERVICES INC

ticker: KELYA


text: Our cybersecurity risk management processes are integrated into our overall business risk management program. As part of our risk management program, we identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity, including AI. As part of risk management processes, we maintain cybersecurity insurance that provides coverage for certain costs related to cybersecurity-related incidents. However, the amount or type of coverage may not be sufficient to address costs for handling an incident, or future changes may occur to insurance coverage.

companyName: Keenova Therapeutics plc


text: Our Cyber Security Incident Response Plan (the "Response Plan") provides the methodology used by the Company to identify and respond to cyber security incidents. The Response Plan serves as a guide to facilitate a consistent and systematic response to cyber security incidents and is designed to (a) prevent or minimize disruption of critical information systems; (b) minimize loss or theft of sensitive information and/or funds; (c) quickly and efficiently remediate, report (including any public or internal company communications or required reporting) and recover from cyber security incidents; and (d) provide a centralized enterprise investigations process. The Response Plan also provides for incorporating lessons learned after an event to prevent future breaches of the same nature.

companyName: Anywhere Real Estate Group LLC


text: Information Security Program Pathward maintains a comprehensive Information Security Program to promote the principles of sound information security governance and to ensure risk-taking activities are in line with the Company's strategic objectives, risk appetite, and regulatory requirements. The Information Security Program governs the confidentiality, integrity, and availability of data, and defines the responsibilities of departments and individuals for such data. The Information Security Program is designed to protect information resources from a wide range of threats to ensure business continuity and minimize business risk.

companyName: PATHWARD FINANCIAL, INC.

ticker: CASH


text: The CNH CISO maintains and periodically updates a Cybersecurity Incident Response Plan which is a guide to respond effectively and efficiently to cybersecurity incidents in a coordinated manner in the interest of minimizing the risk of harm to our customers, operations, partners, employees and third parties, consistent with our legal obligations. As of the date of this report, we do not believe that risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we recognize the ever-evolving cyber risk landscape and cannot provide any assurances that we will not be subject to a material cybersecurity incident in the future. For a description of risks related to our information technology systems, including cybersecurity threats, see Item 1A, "Risk Factors."

companyName: CNH Industrial Capital LLC


text: In an effort to effectively respond to a security event, we follow a comprehensive cybersecurity incident response plan. We regularly review, test and evaluate the plan for effectiveness.

companyName: CPI Card Group Inc.

ticker: PMTS


text: Material cybersecurity incidents are required to be reported to the Board of Directors. As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: FGI Industries Ltd.

ticker: FGI


text: Cybersecurity Risk As a financial institution, we may be the target of a security breach due to a cybersecurity attack. While we have not encountered a cybersecurity incident that has materially impacted our operations or financial results, a security breach due to a cyber-attack in the future could result in a material impact to us, our customers, and our third-party vendors. The risk of such event could increase in the future due to the expansion of mobile banking and other internet-based product offerings, our use of internet-based services for internal and external purposes, acquisition and integration of new products and other offerings, increased use of third-party software solutions, and the growing reliance on mobile devices.

companyName: ISABELLA BANK CORP

ticker: ISBA


text: The Company's Board of Directors has oversight of information security matters at the Company, including reviewing the Company's cybersecurity practices. At least annually, the Vice President of IT presents the Company's information security policies and programs to the Board. Our Audit Committee is tasked with overseeing the risks from cybersecurity threats. Members of the Audit Committee receive updates on cybersecurity matters on a quarterly basis from one or more representatives from the Company's Cyber Security Council ("CSC"), which is composed of our business unit general managers, other members of senior management, our Vice President of IT and our IT Security Manager. These updates include a discussion of existing and new cybersecurity risks (if any), updates on how management is addressing and/or mitigating those risks, and the status of information security initiatives. Other Board members also engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs outside of the scheduled meetings.

companyName: ONTO INNOVATION INC.

ticker: ONTO


text: Index to Financial Statements Internally, the CISO coordinates oversight of reviewing security alerts, identifying and monitoring ongoing and potential cybersecurity threats, evaluating strategic business impacts of cybersecurity threats and developing programs and initiatives to educate the Company's employees regarding cybersecurity. The CISO also manages the Company's Computer Security Incident Response Plan (the "Incident Response Plan"), which outlines action steps for the preparation, identification, triage, analysis, containment, eradication, recovery and reflection stages of a cybersecurity incident. The Incident Response Plan serves as the charter for the Company's Computer Security Incident Response Team (the "Incident Response Team"), which includes a strategic team comprised of executives from various cross-functional management teams, as well as a tactical team comprised of internal technical support roles and external third-party service providers. The Incident Response Plan provides how the Incident Response Team will analyze and, as necessary, escalate cybersecurity incidents both internally and with third-party service providers based on type and severity of the specific incident.

companyName: MOHAWK INDUSTRIES INC

ticker: MHK


text: We have a Cybersecurity Incident Disclosure and Controls Committee (CIDAC) which is central to our response and evaluation of cybersecurity incidents. Our CIDAC is comprised of our CIO and other senior executives including our chief financial officer, chief operating officer and general counsel. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Our IT team is responsible for categorizing cybersecurity incidents, with incidents evaluated to be high or critical security risks brought to the CIDAC for review and evaluation. Incidents are evaluated to determine materiality as well as operational and business impact. Our CIDAC committee performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. External resources and advisors are incorporated as needed.

companyName: KRONOS WORLDWIDE INC

ticker: KRO


text: Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence. Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain.