text: Jack Henry systems and services are subject to regular reviews by the same regulatory agencies that oversee financial institutions, including the Federal Reserve Bank ("FRB"), FDIC, Office of the Comptroller of the Currency ("OCC"), NCUA, and the CFPB, among others. These reviews, including those conducted by the Federal Banking Agencies (comprised of the FDIC, FRB, and the OCC) help identify potential security gaps or control deficiencies. In addition, critical services provided to our clients undergo annual System and Organization Controls ("SOC") reviews by independent auditors.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: Mitigating Third-Party Risk Because we are aware of the risks associated with third-party service providers, Rhinebeck Bank implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers with access to Customer Non-Public Information before engagement and maintain ongoing monitoring to ensure compliance with strict cybersecurity standards.

companyName: Rhinebeck Bancorp, Inc.

ticker: RBKB

secItem: Item 1C


text: The Company has multi-layer processes to assess, identify and manage material risks from cybersecurity threats. These processes are integrated into the Company's enterprise risk management as part of its overall risk management strategy.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO


text: Management's Role and Responsibilities Our CISO is responsible for day-to-day management and oversight of our information security program and leads our cybersecurity organization, which comprises approximately 1,000 professionals globally as of September 30, 2024. Our CISO and President of Technology receive regular reports from our cybersecurity personnel in connection with monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO reports directly to our President of Technology and provides quarterly reports on our cybersecurity performance to the CRC.

companyName: VISA INC.

ticker: V


text: We conduct annual internal audits to ensure compliance with its technology policies, security procedures and controls. Our third-party technology providers, consultants and vendors are vetted by our information security teams to assess cybersecurity risk and mitigation measures, where applicable.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: We have established policies and procedures for assessing, identifying and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We leverage well-known and established third parties as industry partners to support our key business processes and utilize the services of reputable external advisory firms for running important functions such as cybersecurity assessments and technical security management activities, including network security management. Our Chief Financial Officer and Chief Operating Officer are jointly responsible for managing cybersecurity risks and implementing the required policies across the Company. Our Chief Executive Officer is responsible for making strategic decisions and approving external communication releases related to cybersecurity risks or incidents. Our Chief Executive Officer and Chief Financial Officer work closely with our third-party IT manager to stay informed about and monitor the prevention, detection, mitigation and remediation of any potentially significant cybersecurity incidents, including making determinations on the materiality of a cybersecurity incident.

companyName: Applied Therapeutics, Inc.

ticker: APLT


text: The Board of Directors oversees the Company's strategy and risk management, including material risks related to cybersecurity threats. The Board has delegated to the Audit Committee oversight of cybersecurity matters.

companyName: CAPITAL PROPERTIES INC /RI/

ticker: CPTP


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example our information technology MSP.

companyName: SCYNEXIS INC

ticker: SCYX


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not believe that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk, including with respect to the use of third-party service providers. Additionally, we do not engage assessors, consultants, auditors, or other third parties in connection with assessing or overseeing cybersecurity risks. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO and do not believe that cybersecurity threats are reasonably likely to have a material effect on our business strategy, results of operations or financial condition. Please see the risk factor entitled "Cybersecurity risks and cyber incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and confidential information in our possession and/or damage to our business relationships, any of which could negatively impact our business, financial condition and operating results." for further information.

companyName: Achari Ventures Holdings Corp. I


text: Busey's board of directors, as a whole and through its Enterprise Risk Committee (the "Risk Committee"), is responsible for the oversight of risk management. In that role, Busey's board of directors and Risk Committee, with support from Busey's cybersecurity advisors, are responsible for ensuring that the risk management processes developed and implemented by management are adequate and functioning as designed. To carry out those duties, both the board of directors and the Risk Committee receive quarterly reports from Busey's management team regarding cybersecurity risks, and Busey's efforts to prevent, detect, mitigate, and remediate any cybersecurity incidents.

companyName: FIRST BUSEY CORP /NV/

ticker: BUSE


text: In addition, management updates the Audit Committee as necessary regarding any material cybersecurity incidents as well as any incidents with lesser impact potential. The Audit Committee received one report from our Senior Director of Cybersecurity and Compliance in 2024.

companyName: Purple Innovation, Inc.

ticker: PRPL


text: The Company depends on the proper functioning, availability and security of its information systems, including financial, data processing, communications and operating systems. Several information systems are software applications provided by third parties. Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from time to time, experience threats and security incidents related to our and our third-party vendors' information systems, including attempts to gain unauthorized access to our confidential data, and other electronic security breaches. Such cybersecurity attacks can range from individual attempts to gain unauthorized access to our information technology systems to more sophisticated security threats. While we employ a number of measures to prevent, detect and mitigate these threats, there is no guarantee such efforts will be successful in preventing a cybersecurity attack. A cybersecurity attack could compromise the confidential information of our employees, customers and vendors. A successful cybersecurity attack could disrupt and otherwise adversely affect our business operations.

companyName: AmpliTech Group, Inc.

ticker: AMPG


text: Cybersecurity is a key component of the Company's risk mitigation strategy. As such, a multi-year cybersecurity strategy and roadmap are developed and incorporated into Tapestry's long range planning and capital allocation process.

companyName: TAPESTRY, INC.

ticker: TPR


text: Day-to-day management of cybersecurity threats is conducted by our information technology consultant which is charged with identifying and reporting threats to senior management, which then reports to the Board of Directors. Board of Directors is responsible for oversight of management's efforts to eliminate cybersecurity risks.

companyName: SOLESENCE, INC.

ticker: SLSN


text: CNX maintains a comprehensive cybersecurity program that aims to provide a robust, dynamic, and secure environment that protects the confidentiality, integrity, and availability of data required by our business to be stored, analyzed, transported, and/or processed. The Company has implemented various internal and external controls and processes, including appropriate internal risk assessment and policy implementation, incorporating a risk-based cybersecurity framework to monitor and mitigate security threats and other strategies to increase security for our information, facilities, and infrastructure.

companyName: CNX Resources Corp

ticker: CNX


text: Information technology supports all aspects of our business, including operations, marketing, sales, order processing, production and distribution networks, retail and Pro customer experience, consumer experience, finance, business intelligence, and product development. We continue to maintain and enhance our information technology systems, cybersecurity infrastructure and customer and consumer experiences in alignment with our long-term business strategy. An increasing portion of our global information technology infrastructure is cloud-based and is built and maintained in partnership with industry-leading service providers. We believe this approach enables a high-performance platform to support current and future requirements and enhances our scale and flexibility to respond to the demands of the business by leveraging advanced and leading-edge technologies. We recognize that technology presents opportunities to build a competitive advantage, and we continue to invest in new capabilities across various aspects of our business. Such efforts, however, subject us to increased cyber risk, as technology investments are subject to cyberattacks, business disruptions and other risks described in "Risk Factors – Risks Related to Information Technology and Cybersecurity" included in Part I. Item 1A of this Annual Report.

companyName: OLAPLEX HOLDINGS, INC.

ticker: OLPX


text: The Registrants manage cybersecurity risks through monitoring, defense and response tools, including independent third-party assessments, internal audit assessments of the program's effectiveness, intelligence reports, cybersecurity threat trends, implementation of governance models, industry collaboration and employee training and awareness. The Registrants are actively engaged in cybersecurity related industry forums, public-private partnerships with law enforcement, cross-industry peer groups, and other efforts to help improve the protection of the U.S. electric grid.

companyName: PPL ELECTRIC UTILITIES CORP


text: We work with third-party vendors to enhance our processes against the occurrences and impact of unauthorized access to our network, computers, programs, and data. Risk is inherent in risk management and strategy for cybersecurity. See "Risk Factors" in Part I, Item 1A in this report for further discussion.

companyName: VALMONT INDUSTRIES INC

ticker: VMI


text: Our board administers its cybersecurity risk oversight function directly through our audit committee. Our audit committee has primary responsibility for overseeing our risk assessment and risk management policies (including with respect to cybersecurity matters). Our audit committee regularly discusses with management, counsel, and auditors the Company's major risk exposures. This includes potential financial impact on the Company and the steps taken to monitor and control those risks. Additionally, our board is informed regarding the risks facing the Company and coordinates with management and our cybersecurity team to ensure our board receives regular risk assessment updates from management.

companyName: Lucid Diagnostics Inc.

ticker: LUCD


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third -party risk management process for service providers, suppliers, and vendors. In the last three fiscal years, the Company has not experienced any material cybersecurity incidents.

companyName: SERVOTRONICS INC /DE/


text: Unauthorized Remote Access: Vulnerabilities in remote access points can be exploited by attackers to gain control over systems, potentially disrupting water services. Malware and Ransomware: Malicious software can infiltrate systems, leading to operational disruptions, data breaches, or ransom demands. Cybercriminals can encrypt critical data and demand a ransom for its release, potentially disrupting water supply and treatment processes.

companyName: YORK WATER CO

ticker: YORW


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of steps the Company has taken to monitor or mitigate significant cybersecurity risks. The Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: CHEESECAKE FACTORY INC

ticker: CAKE


text: At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation, and the CISO is also continually informed about any developments in cybersecurity, including potential threats and industry techniques for risk management to address those threats. The role of the CISO includes implementation and oversight of effective processes to monitor our information systems, including the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. The CISO regularly reports to senior management on our cybersecurity risks and actions taken to mitigate that risk.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: The Nominating & Governance Committee of our Board of Directors, which is comprised entirely of independent directors, has primary responsibility for oversight of the Company's initiatives, policies and performance regarding risk management matters, including information security, cybersecurity, business continuity and data protection and privacy. Committee members have extensive experience working for and/or serving on the boards of directors of publicly traded companies and are experienced in overseeing cybersecurity and information security risks, understanding the cybersecurity threat landscape and/or assessing emerging cybersecurity risks. The Nominating & Governance Committee generally meets at least quarterly and as frequently as circumstances dictate. Members of senior management, representing a variety of teams and functions including information technology, operations, finance and legal, routinely provide updates regarding assessments of cyber risks, the threat landscape, and the Company's cybersecurity risk mitigation and governance strategies. The Nominating & Governance Committee and members of senior management brief the entire board, as necessary, on cybersecurity matters discussed during committee meetings.

companyName: Amplify Energy Corp.

ticker: AMPY


text: We test our ability to respond to cybersecurity incidents on a recurring basis. Additionally, we engage third-party service providers to assist with the ongoing monitoring for cybersecurity events and incidents, as well as to complete risk quantification analysis and perform penetration and vulnerability testing. If any gaps are identified, the third-party service providers also assist with incident assessment and response. We conduct thorough up-front security assessments of all third-party providers before engagement, led by our Vice President, Chief Information Office (CIO) and our cybersecurity team, and we maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This approach is designed to mitigate risks related to security incidents originating from third-parties.

companyName: TENNANT CO

ticker: TNC


text: Risk oversight and management is a key role for the Board and its committees. The Board is responsible for identifying and understanding Enbridge's principal risks and ensuring that appropriate systems are implemented to monitor, manage and mitigate those risks. The committees of the Board have oversight over risks within their respective mandates.

companyName: ENBRIDGE INC

ticker: ENB


text: The risks from cybersecurity threats, including any previous cybersecurity incidents, have not materially affected the Corporation to date, including our business strategy, operations, or financial condition. Cybersecurity is an evolving threat that does have the potential to materially affect the Corporation, including our business strategy, operations, or financial condition. However, with our system of internal controls, cyber defense mechanisms in place and the tenure and experience of our Chief Information Security Officer ("CISO") and Information Security Analysts, we have sought to reduce the residual risk that is inherent of cybersecurity.

companyName: CHEMUNG FINANCIAL CORP

ticker: CHMG


text: Ongoing Evaluation and Assessment of Systems and Procedure : We monitor compliance with regulatory, industry and evolving data privacy requirements and update our cybersecurity risk management program from time to time as appropriate. We also continuously monitor our information security systems and processes on an ongoing basis to identify and remediate cybersecurity threats and vulnerabilities that could be exploited to adversely impact our business operations. To better preemptively identify risks and vulnerabilities in our security systems, we perform penetration testing for security controls using external third-party tools and encourage vulnerability reporting within our organization.

companyName: MAGNACHIP SEMICONDUCTOR Corp

ticker: MX


text: While we do not believe that our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are constant, and, like other financial institutions, we, as well as our customers, employees, and third-party service providers, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber-attacks. We continue to assess the risks and changes in the cyber environment, reasonably invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities. See the risk factor "Our business is heavily reliant on information technology systems, facilities, and processes; and a disruption in those systems, facilities, and processes, or a breach, including cyber-attacks, in the security of our systems, could have significant, negative impacts on our business, result in the disclosure of confidential information, and create significant financial and legal exposure for us." in "Item 1A. Risk Factors" of this Form 10-K for more information.

companyName: SIMMONS FIRST NATIONAL CORP

ticker: SFNC


text: The Compliance team, led by our Chief Compliance Officer, develops and implements our strategy, as well as monitors systems and devices for risks and threats.

companyName: OneMedNet Corp

ticker: ONMD


text: Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: POTBELLY CORP

ticker: PBPB


text: Our dedicated 24x7 Security Operations Center incorporates specialized systems and processes for handling security incidents into its regular work and operates a robust, modern security infrastructure with appropriate security sensors and event monitoring capabilities. Upon detection of a cybersecurity incident, the Security Operations Center determines the severity of the incident in accordance with a pre-established incident severity matrix, initiates the appropriate notification and escalation protocols and begins triage. Predefined severity tiers serve as a guide to match our response to each incident's determined severity or risk level.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: Periodic audits are performed by our Internal Audit team as part of the Company's compliance with the Incident Management and Information Security Plan and the overall ERM framework.

companyName: UNIVERSAL INSURANCE HOLDINGS, INC.

ticker: UVE


text: ii. Technical Safeguards – Multi-layered controls, defenses, and continuous monitoring tools are used to protect, detect, and respond to cyber threats and incidents. External independent assessments, regular threat intelligence review, and lessons learned from incident response drive continuous tool and process improvements.

companyName: CENTRAL PACIFIC FINANCIAL CORP

ticker: CPF


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "An information systems interruption or breach in security, including as a result of cyber-attacks, could adversely affect the Company's business, results of operations and reputation."

companyName: EMERSON RADIO CORP

ticker: MSN


text: The Registrants have been subject to attempted cybersecurity threats and will likely continue to be subject to such attempts in the future. While PPL has not determined any cybersecurity incidents have materially affected the Registrants, including their business strategy, results of operations or financial condition, there can be no guarantee that the Registrants will not be the subject of future attacks, threats or incidents, the consequences of which may be material.

companyName: PPL ELECTRIC UTILITIES CORP


text: Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like risk management, business continuity planning, brand management, and other relevant matters.

companyName: Vanda Pharmaceuticals Inc.

ticker: VNDA


text: Internal Cybersecurity Team Our internal cybersecurity team is responsible for the development, implementation, monitoring, and maintenance of the cybersecurity and data protection practices across the Company. Reporting to our IT Director are experienced personnel with training to assist with managing cybersecurity objectives and to implement related policies and tools. Our internal cybersecurity team includes a manager who is a Certified Information Systems Security Professional and Systems Security Certified Practitioner. Also, the internal cybersecurity team conducts periodic security awareness training for employees. In addition to our internal cybersecurity capabilities, we also regularly engage consultants to assist with assessing, identifying, and managing cybersecurity risks and optimize infrastructure.

companyName: FORUM ENERGY TECHNOLOGIES, INC.

ticker: FET


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is identified in and a component of the Company's risk register; (2) the CISO Team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; and (3) our information security team evaluates material risks from cybersecurity threats against our overall business objectives and reports to the board of directors, which evaluates our overall enterprise risk.

companyName: Rubrik, Inc.

ticker: RBRK


text: Cohen & Steers has implemented and maintained various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to Information Systems and Data, including, but not limited to: • technical and physical safeguards: (i) systems monitoring, including anti-virus/anti-malware software for workstations and servers, reports about correlated events detected from server log reviews, desktop forensics software and suspicious firewall traffic, firewall logs and alerts from users about blocked websites, systems monitoring of Cohen & Steers' websites, network monitoring software alerts and scheduled internal and external vulnerability scans; (ii) Cohen & Steers' asset management tracking and disposal; (iii) incident detection and response; (iv) data encryption; (v) notification monitoring from Cohen & Steers' personnel and from third parties regarding issues and signs of potential incidents; and (vi) access controls and network security controls; and • organizational safeguards: (i) incident response plans that address Cohen & Steers' response to a cybersecurity incident; (ii) personnel and vendors dedicated to overseeing Cohen & Steers' cybersecurity program; (iii) periodic mandatory employee cybersecurity training; (iv) periodic risk assessments and testing of Cohen & Steers' policies, standards, processes and practices that are designed to address cybersecurity threats and incidents, such as audits, tabletop exercises, threat modeling and vulnerability testing; (v) policies and programs such as security standards, a vendor risk management program, a vulnerability management policy and disaster recovery and business continuity plans; and (vi) insurance coverage dedicated to losses resulting from cybersecurity incidents.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: Disclosure of the Board's Roles and Responsibilities The Board of Directors is responsible for global oversight of our strategic and operational risks. The Audit Committee assists the Board of Directors with this responsibility by reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of management. The Audit Committee, in turn, periodically reports its findings to the Board of Directors.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: In order to mitigate data or security incidents that may originate from third-party vendors or suppliers, we conduct both privacy and security assessments to properly identify, prioritize, assess and remediate any third-party risks, and we require security and privacy addenda to our contracts where applicable. We currently maintain a cyber insurance policy that provides coverage for security breaches; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, or other related breaches.

companyName: DESTINATION XL GROUP, INC.

ticker: DXLG


text: We maintain the availability of cybersecurity consultants as required and regularly conduct vulnerability scans within our environment to identify areas for ongoing enhancements. Additionally, our IT General Controls (ITGC) undergo audits, encompassing processes that overlap with cybersecurity concerns such as access control, permissions, and robust password management. The insights derived from these and other assessments guide us in refining our information security practices, procedures, and technologies.

companyName: Li-Cycle Holdings Corp.


text: We are committed to maintaining the trust we have established with our customers and associates. They expect that we will protect their personal information. Our comprehensive privacy program includes standards and practices focused on keeping data we collect secure and reflects our commitment to respecting privacy rights. Our Privacy Policy is available on our website and we continually assess and update this Policy to reflect industry best practices and applicable laws and regulations.

companyName: Childrens Place, Inc.

ticker: PLCE


text: The Company's CTTO leads the core elements of Ulta Beauty's IT and Digital functions, including IT infrastructure, systems and security, digital experience and operations, and consumer technology. He has served in various roles in information technology and information security for over 30 years, including serving as the Global Chief Technology Officer of a large public company prior to joining the Company. The Vice President IT Risk Management leads our information risk management organization responsible for overseeing the Company's information security program. She has over 25 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies.

companyName: Ulta Beauty, Inc.

ticker: ULTA


text: Our various cybersecurity risk management processes apply to various functions, including but not limited to, third-party suppliers and vulnerability management. We employ processes and technologies to bring visibility to, and protect against, cybersecurity risk, to include real time monitoring of network traffic and email. The Company also has a comprehensive body of policies and standards for assessing, identifying, and managing material risks from cybersecurity threats, including an incident response plan, business continuity plan, crisis management plan, as well as disaster recovery mechanisms, which are tested and updated. Additionally, the Company employs staff that are specifically dedicated to raising cybersecurity awareness and training within the organization.

companyName: Alcoa Corp

ticker: AA


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: Arcadia Biosciences, Inc.

ticker: RKDA


text: We assess materiality of cybersecurity incidents based on the type of breach, whether any information was accessed, the nature of the information accessed, and the potential for business interruption. As of the date of this report, we are not aware of any material incidents from cybersecurity threats, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: Laird Superfood, Inc.

ticker: LSF


text: Except as otherwise specifically stated therein, the description of the Company's cybersecurity risk management program set forth is as of February 3, 2024 (the last day of the Company's 2023 fiscal year), which was prior to the completion of the Sale Transaction. Although our Board of Directors (the "Board") still oversees cybersecurity risks, due to limited resources and personnel following the Sale Transaction, we currently no longer have in place the cybersecurity risk management program and governance structure described below, which may make us susceptible to heightened cybersecurity risks.

companyName: EXP OldCo Winddown, Inc.


text: We undertake to align our cybersecurity approach, which encompasses both enterprise security and operational security, along with the standards of the National Institute of Standards and Technology Cybersecurity Framework. We maintain continuous cyber threat-detection systems and have established an incident response plan, which contains playbooks for addressing and recovering from potential material cyberattacks and breaches of data security. We also have controls in place to ensure any third-party access to our internal systems adhere to internal cybersecurity safeguards, as well as firewalling any access from such third-parties, including service providers, through a secure virtualization layer. In addition to security measures for third-party service providers, we require periodic training covering cybersecurity and information management and conduct regular cybersecurity awareness campaigns.

companyName: CARRIAGE SERVICES INC

ticker: CSV


text: We have established a process to assess the nature, scope and timing of a cyber incident and, as appropriate, communicate the facts of an incident to management and the Board of Directors and, as appropriate, investors. In the event of a cybersecurity incident, the incident response team is responsible for notifying senior management in a timely manner, to the extent that the facts and circumstances of a particular incident warrant such notification. If it is determined that the event is material to the Company, the matter will be escalated to the Board. For material incidents, the Company will provide information regarding the nature and scope of the incident to investors in compliance with SEC regulations.

companyName: CABOT CORP

ticker: CBT


text: The Fund engages various third parties, including vendors and service providers, to assist with operating its business. The Fund relies on the expertise of cybersecurity risk management, legal, information technology, and compliance personnel that have been engaged by the Investment Adviser when identifying and overseeing risks from cybersecurity threats associated with the Fund's use of such entities.

companyName: Wellings Real Estate Income Fund


text: DuPont deploys annual cybersecurity training for employees and considers this a critical step in safeguarding the Company's data and assets. The training provides employees and contractors with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. The course includes enhancements to strengthen our defensive stance against the increasing number and sophistication of cyberattacks worldwide and includes interactive modules covering various areas, including insider attacks, phishing and email attacks, preventing malware attacks, data protection, data handling, passwords, cloud and internet security and cybersecurity fundamentals for mobile devices.

companyName: DuPont de Nemours, Inc.

ticker: DD


text: We engage external parties to supplement our internal capabilities and to assess our cyber maturity and readiness on a periodic basis. This includes being party to a managed services agreement with an external party for incident response; engaging an external party for comprehensive cybersecurity assessment, opportunity prioritization, initiative road mapping and cyber project delivery; and engaging additional external parties to assist with critical cyber-related infrastructure such as firewall maintenance and upgrade initiatives. While utilizing third-party service providers presents risk, we assess all third-party service providers for their qualifications before engaging them and monitor such providers throughout the term of the engagement in order to help protect us from any additional vulnerabilities.

companyName: CASELLA WASTE SYSTEMS INC

ticker: CWST


text: Although, as a blank check company, we do not have any operations, we are nonetheless subject to the risk of cybersecurity incidents. Among other things, the investments in our Trust Account and bank deposits may be vulnerable to such incidents, and we may depend on the digital technologies of third parties. We and third parties may be subject to cybersecurity attacks or security breaches. To the extent that we rely on the technologies of third parties, we depend upon the personnel and the processes of such third parties to protect against cybersecurity incidents, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, our Management Team will report to the Board of Directors and provide updates on the Management Team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering. In addition to our own cybersecurity risks, any proposed Business Combination target may have been subject to, or may in the future be subject to, cybersecurity incidents.

companyName: Haymaker Acquisition Corp. 4

ticker: HYAC


text: Cybersecurity incidents detected by Liberty Global's cybersecurity team are evaluated internally based on their severity, with more serious incidents being escalated, as appropriate, to the highest levels of management, including the company's CTO, General Counsel, and, ultimately, its CEO. These members of the company's executive leadership team are provided with details of the type and severity of the attack, the company's planned response to the incident and are briefed on what information was accessed and the impact such incident has had or is expected to have on the company's operations, as well as any financial or regulatory implications resulting from the incident.

companyName: Liberty Global Ltd.

ticker: LBTYA


text: Policies and Procedures. The Company maintains a set of cybersecurity policies and procedures that are regularly reviewed and updated. These policies are crafted in accordance with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, which provides a policy foundation for critical infrastructure security. These policies govern the Company's cybersecurity program, including but not limited to access control, system development life cycle management, change management, and incident response.

companyName: EVgo Inc.

ticker: EVGO


text: The Company proactively mitigates its financial exposure to cybersecurity incidents by maintaining a cyber liability insurance policy. However, the Company's cyber liability insurance may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, the Company's cyber liability insurance policy may not cover all claims made against the Company. Defending a suit, regardless of its merit, could be costly and divert management's attention from the Company's business and operations. To date, Actinium has not experienced any material cybersecurity incident that affected the Company's operations or financial condition.

companyName: Actinium Pharmaceuticals, Inc.

ticker: ATNM


text: The preparation phase of our IRP includes maintaining protective measures to minimize the likelihood and impact of a security incident, regularly reviewing and updating our policies and procedures to maintain alignment with industry standards and guidance, and periodic training of all Company personnel on information security, data privacy, and the procedures to reporting suspected incidents.

companyName: ContextLogic Inc.


text: The Company has processes in place for assessing, identifying and managing material risks from cybersecurity threats. Our processes include, but are not limited to, the following: • Engaging cyber security consultants, auditors, and other third parties to assess and enhance our cybersecurity practices; • Providing periodic training and testing, including phishing tests, to help our employees understand cybersecurity risks and their responsibility in mitigating those risks; and • Employing a variety of preventative and detective tools designed to monitor and block suspicious activity.

companyName: Velocity Financial, Inc.

ticker: VEL


text: Technological safeguards that are designed to protect the Company's information systems from cybersecurity threats, including the prevention and detection of system applications, access controls, and firewalls, which the Company assesses the vulnerability and severity of potential cybersecurity threats and makes necessary improvements. Utilization of third parties as part of the Company's risk-based approach in identifying and overseeing cybersecurity risks.

companyName: Perma-Pipe International Holdings, Inc.

ticker: PPIH


text: Periodic cyber risk assessments of our operational technology network help us identify risks, which we address using risk-based analysis and judgment. We also conduct internal and external testing of software, hardware, and defensive systems in our efforts to uncover potential vulnerabilities. Third-party security firms are employed for certain controls and technology operations, including vulnerability scans and penetration testing. Our approach to managing third-party cybersecurity threats includes pre-acquisition due diligence, contractual obligations, and ongoing performance monitoring.

companyName: STAR GROUP, L.P.

ticker: SGU


text: Our management recognize the importance of maintaining the security and resiliency of our cybersecurity environment to deliver on the expectations of our employees and investors. Overall, the purpose of our information security program is to protect the confidentiality, integrity and availability of our systems and data, along with the safe operation of our systems. Our current processes are limited and reflect the transitional state of our business and lack of resources. If and when our business evolves and we obtain additional resources, we would expect to adapt our processes accordingly.

companyName: EXICURE, INC.

ticker: XCUR


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with an IT consultant who reports to our Chief Compliance Officer to manage the risk assessment and mitigation process.

companyName: Jaguar Health, Inc.

ticker: JAGX


text: We intend to leverage the support of third-party information technology and security providers, including to perform a risk assessment designed to identify, assess, and manage cybersecurity risks. Further, we will develop a formal, documented process to assess the data protection practices of certain third-party vendors that may handle sensitive information on our behalf.

companyName: Pioneer Green Farms, Inc.


text: Cybersecurity incidents are assessed for actual or potential impact on the business and any relevant data subjects. Materiality of cybersecurity incidents is assessed and determined by the Cybersecurity Team, which has been assigned this responsibility by our Disclosure Committee. The Cybersecurity Team consists of the Chief Financial Officer, the General Counsel, the Vice President - Commercial Excellence, the Vice President - Global Systems and the Senior Director - Information Security. The Senior Director - Information Security reports regularly to our Disclosure Committee. In the event a cybersecurity incident is determined to have, or is likely to have, a material impact on RPM, the Chair of the Audit Committee of the Board of Directors is directly notified by the General Counsel in coordination with the Chief Financial Officer and Senior Director - Information Security.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: Management is responsible for day-to-day risk management activities, including those relating to information systems and cybersecurity. We employ an internal chief information security officer ("CISO") who has more than 25 years of technology industry leadership, cybersecurity expertise, and engineering and operations experience. Our CISO and his team of certified security subject matter experts (collectively, "Information Security") have deep experience and expertise in cybersecurity and lead our organizational efforts to assess and manage material risks associated with our information systems and cybersecurity threats. Our dedicated Information Security Steering Committee regularly reviews our most significant information security risks, strategic projects, and KPIs. On a quarterly basis, Information Security also meets with business segment leadership to discuss the most significant risks, including identifying potentially material risks and developing, implementing, and applying reasonable risk mitigation processes.

companyName: CLARIVATE PLC

ticker: CLVT


text: c.the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; d.cybersecurity awareness training of our employees;

companyName: e.l.f. Beauty, Inc.

ticker: ELF


text: Engage Third-parties on Risk Management We engage a range of external experts, including consultants, auditors, and cybersecurity assessors, who assist us in evaluating and testing our cybersecurity systems and processes. These partnerships are intended to give us access to specialized knowledge and insights that can inform our cybersecurity strategies and processes, including as to industry-standard control frameworks and applicable regulations, laws, and standards.

companyName: electroCore, Inc.

ticker: ECOR


text: Cyberattacks are a growing geopolitical risk, becoming larger, more frequent, more intricate and more relentless. These attacks represent a significant threat to individual organizations and their ability to conduct daily operations. We rely on accounting, financial, and operational management information systems to conduct our operations. Any disruption in these systems could adversely affect our ability to conduct our business. Furthermore, as part of our normal business activities, we collect and store common confidential information about customers, employees, vendors, and suppliers. This information is entitled to protection under a number of regulatory regimes.

companyName: Ispire Technology Inc.

ticker: ISPR


text: We use a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. For third parties that we rely upon for certain IT systems, we seek to use only reputable providers, to use the most recently reliable versions of such systems, and monitor and address alerts for potential vulnerabilities to any such systems.

companyName: MARIN SOFTWARE INC


text: As discussed in greater detail in Item 1A., "Risk Factors," the company faces numerous and evolving cybersecurity threats, including risks originating from the increased use of AI, intentional acts of individual and groups of criminal hackers, hacktivists, state-sponsored organizations, nation states and competitors; from intentional and unintentional acts or omissions of customers, contractors, business partners, vendors, employees and other third parties; and from errors in processes or technologies, as well as the risks associated with the number of customers, contractors, business partners, vendors, employees and other third parties working remotely. While the company continues to monitor for, identify, investigate, respond to and remediate cybersecurity risks, including incidents and vulnerabilities, there have not been any that have had a material adverse effect on the company, though there is no assurance that there will not be cybersecurity risks that will have a material adverse effect in the future.

companyName: INTERNATIONAL BUSINESS MACHINES CORP

ticker: IBM


text: Our executive management team has established an enterprise risk management ("ERM") program, which includes an evaluation of our cybersecurity program as well as associated risks and risk mitigation strategies. Our ERM program is led by the Vice President of Internal Audit and our ERM Committee, which is comprised of members of senior management, including our CEO, Chief Financial Officer, Chief Information Officer ("CIO"), Chief Information Security Officer ("CISO") and Chief Legal Officer. Our cybersecurity policies, standards, processes and practices are integrated into our ERM program and leverage the National Institute of Standards and Technology guidelines. Generally, we seek to address cybersecurity risk through a cross-functional approach in an effort to preserve the confidentiality, security and availability of information that we collect, store and otherwise process. For a description of the risks from cybersecurity threats that could materially and adversely impact us and how they may do so, see our risk factors under Part I, Item 1A "Risk Factors—Risks Related to Our Business" of this Report.

companyName: HERC HOLDINGS INC

ticker: HRI


text: Our cybersecurity risk management and strategy are integrated into our enterprise-wide risk management (ERM) program, which leverages a "three lines of defense" model to manage risk within the organization. Such model incorporates 1) day-to-day/operational activities and controls that are managed at the business unit level; 2) identification, measurement and mitigation of inherent security risks via the use of internal control and cybersecurity maturity frameworks, operating policies, independent monitoring, risk management and compliance oversight; and 3) internal audit designed to provide objective and independent validation of the design and operating effectiveness of cybersecurity and information security controls. Technology risk (including cybersecurity and overall operational risk) is identified as a key risk area for the Company, and utilizes a combination of manual and automated methods as well as internal and external resources to monitor, measure and mitigate cybersecurity risks.

companyName: First Financial Northwest, Inc.


text: Board of Directors Oversight of Cybersecurity Risk Our board of directors is responsible for oversight of our enterprise risk management program, which incorporates cybersecurity risk. The audit committee undertakes primary responsibility for assisting the board of directors in overseeing cybersecurity risk, including policies and procedures for assessing, managing and responding to cybersecurity risk. The audit committee meets with appropriate members of our management team at least quarterly—and third-party assessors, consultants and auditors as needed—to review and discuss cybersecurity risk.

companyName: Frontdoor, Inc.

ticker: FTDR


text: The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and designed to anticipate cyber-attacks and prevent breaches; Cybersecurity awareness training of our employees, incident response personnel, and senior management; A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents;

companyName: BurgerFi International, Inc.


text: Risk Management Strategy We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: As of the date of this Annual Report, the Company has not experienced any material cybersecurity incidents. Cybersecurity risks that are not currently known to the Company, or that are currently deemed immaterial, could materially affect the Company's business, operations, or financial condition in the future.

companyName: KESTRA MEDICAL TECHNOLOGIES, LTD.

ticker: KMTS


text: Risk Management and Strategy have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information that is also appropriate for a business at our stage of development.

companyName: Namliong SkyCosmos, Inc.

ticker: NLSC


text: Key components of our cybersecurity risk management program include: • periodic risk assessments designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our detection and response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, evaluate, test or otherwise assist with aspects of our security controls and processes; • active testing including penetration tests, attack simulations and tabletop exercises; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party cyber risk management process for vendors including, among other things, a security assessment and contracting program for vendors based on their risk profile.

companyName: ADVANCED MICRO DEVICES INC

ticker: AMD


text: The ERC provides updates to the Board quarterly, including on changes to security risks and outcomes. The CISO also promptly informs and updates the ERC and the Board of the Sponsor any information security incidents that may pose a material risk to the Sponsor. The Sponsor contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are included in reporting to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally included in reporting to the ERC and Board.

companyName: Grayscale Stellar Lumens Trust (XLM)

ticker: GXLM


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Audit Committee of the Board has oversight responsibility for the Company's Enterprise Risk Management (ERM) framework, including managing cybersecurity threat risks and cybersecurity incidents. Specifically, the Audit Committee oversees the design, implementation and maintenance of an effective ERM framework for the Company's overall operational, information security, strategic, reputational, technology, and other risks. To fulfill its oversight responsibility, the Audit Committee also regularly reviews, consults, and discusses with management on strategic direction, challenges, and risks faced by the Company. The Audit Committee also regularly receives management reports on information security and enhancements to cybersecurity protections, including benchmarking assessments, which it then shares with the Board. Included among the members of both the Board and the Audit Committee are directors with substantial expertise in cybersecurity matters, and Board members actively engage in dialogue on the Company's information security plans, and in discussions of improvements to the Company's cybersecurity defenses. When, in management's or the Board's judgment, a threatened cybersecurity incident has the potential for material impacts, management, the Board and applicable committees of the Board will engage to assess and manage the incident.

companyName: NCR Atleos Corp

ticker: NATL


text: Our Vice President of Cloud Technology has been with Pega for seven years and has twenty-five years of networking and security management experience, with seventeen years of leadership roles in cloud services and related information security issues.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also periodically receives briefings from management on our cyber risk management program and an annual report from management on our cybersecurity risks.

companyName: Arcutis Biotherapeutics, Inc.

ticker: ARQT


text: We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our results of operations and financial condition, under the heading "Our business is subject to the risks of earthquakes, fire, flood, crop losses, epidemics, and other catastrophic natural events, and security breaches, including cybersecurity incidents." in Item 1A, "Risk Factors" of Part I of this report.

companyName: Arcadia Biosciences, Inc.

ticker: RKDA


text: FirstEnergy seeks to protect its customers, employees, facilities and the ongoing reliability of the electric system. FirstEnergy works closely with state and federal agencies and its peers in the electric utility industry to identify physical and cyber security risks, exchange information, and put safeguards in place to comply with strict reliability and security standards. From a security standpoint, the electric utility sector is one of the most regulated industries.

companyName: FIRSTENERGY CORP

ticker: FE


text: The day-to-day monitoring, identification, and assessment of information security risks and incident response functions are managed centrally by our core cyber incident response team (the "CIRT"), which operationalizes our Cyber Incident Response Plan (the "Plan"). The Plan includes processes to triage, assess severity of, escalate, contain, investigate and remediate information security incidents, including those associated with our third-party service providers, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Under the Plan, the CIRT may escalate matters as necessary to our CISO and CIO, Chief Legal Officer, and other senior leadership, depending on the severity classification of the incident. In addition to the ordinary-course Board and Audit Committee reporting and oversight described above, we also maintain disclosure controls and procedures designed for prompt reporting to the Board and timely public disclosure, as appropriate, of material events covered by our risk management framework, including information security risks.

companyName: WHIRLPOOL CORP /DE/

ticker: WHR


text: Our board of directors has responsibility for the direction and oversight of our risk management. Our board of directors administers this oversight function directly, with support from its committees. In particular, the audit committee of our board of directors (the "audit committee") has the responsibility to consider and discuss our major financial risk exposures and the steps our Manager takes, or is required to take, to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken. Our audit committee also monitors compliance with legal and regulatory requirements, in addition to overseeing the performance of our internal audit function.

companyName: TPG RE Finance Trust, Inc.

ticker: TRTX


text: We have combatted cybersecurity threats in the normal course of business, but prior cybersecurity incidents have not materially affected, and do not appear likely to materially affect, our operations, business strategy, results of operations or financial condition. However, our Enterprise Risk Management program has recognized that we face ongoing risks from cybersecurity threats that, if not successfully prevented or mitigated, could materially affect us, including our operations, business strategy, results of operations or financial condition. For additional information on such risks, see Item 1A, Risk Factors, of this Annual Report on Form 10-K.

companyName: BEST BUY CO INC

ticker: BBY


text: As an energy transition, renewable energy and investment management company that acquires, constructs and operates renewable energy and energy efficient projects, as well as finances the construction and/or operation of these and other sustainable development projects and businesses and provides through GCM investment management services to funds within the sustainable infrastructure and renewable energy industry, cybersecurity risk management is an integral part of our overall enterprise risk management program.

companyName: Greenbacker Renewable Energy Co LLC


text: Nominating and Corporate Governance Committee The NCG Committee oversees risks associated with data privacy and information security, which encompasses cybersecurity. Our CSO and Chief Compliance Officer, among other executives, provide periodic reports to the NCG Committee and also meet with the NCG Committee to discuss any material events when they arise. The periodic reports are designed to keep the NCG Committee abreast of the Company's cybersecurity practices, risks and trends in cybersecurity threats. The NCG Committee also has discussions with management focused on evaluating the Company's exposure to cybersecurity risks and cybersecurity practices in place to mitigate such risks. These discussions enable the NCG Committee to be informed of the steps management is taking to detect, monitor and manage cybersecurity risks. These reports to the NCG Committee typically include information on any significant incidents that have occurred, how they were managed, and any changes to the risk profile of the Company. The NCG Committee seeks updates to facilitate proactive governance and to allow the NCG Committee to address emerging cybersecurity issues with management.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program, overseen by the Adviser's Global Head of Infrastructure & Cybersecurity ("GHIC"), which is designed to assess, identify, and manage material cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: BC Partners Lending Corp


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director for IT, who has 25 years of leadership experience in information security, and various IT and security certifications, including certified information systems security professional (CISSP).

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: Our primary objectives for managing cybersecurity risk are to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt, exploit or misuse our information or systems. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. The NIST cybersecurity framework is a nationally recognized industry standard for mitigating organizational cybersecurity risks, which includes identifying risks, protecting assets, detecting threats, responding to incidents, and recovery from incidents. The NIST cybersecurity framework uses standards, procedures and best practices, and is integrated into the HTLF Security team's overall risk management system and processes, including oversight of third-party service providers. Management of the HTLF's third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven from risk factors established by Enterprise Risk Management through its Third Party Risk Management Program. The process provides awareness and collaboration across all internal teams including Information Security and Business Continuity. A technical requirements review process is conducted on new or significantly changed third parties, applications, or technology to ensure that systems or third parties meet certain security baseline requirements. Further, HTLF's Security program also provides for annual mandatory training for employees regarding security awareness and understanding of how to properly use and protect the company assets, including computing resources entrusted to them, and to communicate the company's information security policies, standards, processes and practices.

companyName: HEARTLAND FINANCIAL USA INC


text: o Legal Oversight: Management and the board ensure we have appropriate legal counsel to address cybersecurity-related issues, including breach notification requirements.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: Management is responsible for identifying and assessing material risks for the business on an ongoing basis, including in relation to cybersecurity. Our Chief Executive Officer oversees our information technology department which monitors the prevention, detection, mitigation, and remediation of cyber incidents, if any.

companyName: MULIANG VIAGOO TECHNOLOGY, INC.


text: Incident Management: EQT has implemented a security incident response plan for prompt and effective handling of cyber incidents. This plan is executed by a tiered response team: a 24/7 Security Operations Center serves as the first line of defense, followed by EQT's internal security team as the second tier, and an expert incident response and forensics firm as the third. Additional support from external legal counsel is available when necessary. The strategy ensures collaboration with key functions like Risk, Regulatory & Compliance, Corporate Legal and Communications. Detailed playbooks within the plan outline specific actions for various security incident types. At the corporate level, an incident reporting and management process involves EQT's Chief Information Security Officer ("CISO"). Should an incident pertain to cybersecurity, it activates the security incident response plan.

companyName: EQT Exeter Real Estate Income Trust, Inc.


text: We have developed, implemented and maintained robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. These measures are included within our overall risk management process. As part of this process, all detected cybersecurity threats and incidents are logged and escalated to the Chief Information Security Officer ("CISO") and Chief Compliance Officer, who report to our Chief Legal Officer. Annually or more frequently if needed, the CISO meets with the other stakeholders to assemble the company's Risk Register. Cyber risks are an integral part of this process and the CISO and their team regularly assess the current cyber risk landscape, assess L&W's susceptibility to those cyber risks, and use that analysis as feedback to the overall Risk Register.

companyName: Light & Wonder, Inc.

ticker: LAWIL


text: The potential impact of risks from cybersecurity threats posed to the Company are assessed on an ongoing basis, including how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition. Key third-party information security service providers, subject to the Adviser Committee's and Company CCO's oversight, continuously monitor and support the Adviser and Company information security control environment and breach notification processes. The Adviser's Committee, subject to the Company CCO's oversight, monitor best-practices and developments in data privacy and security, including increased scrutiny of third-party service providers having access to sensitive Company data.

companyName: Commonwealth Credit Partners BDC I, Inc.


text: Board Governance and Management The FE Board has identified cyber security as a key enterprise risk and prioritizes the mitigation of this risk through FirstEnergy's enterprise risk management process. Responsibility for oversight of risk management generally lies with the FE Board and the FE Audit Committee has primary responsibility to oversee enterprise risk management. To effectively manage oversight of FirstEnergy's cyber security risk management practices, since 2022, the FE Board has delegated oversight authority to each of FE's Audit and Operations and Safety Committees, respectively, as detailed in each Committees' charters. The FE Audit Committee has primary responsibility to oversee the disclosure of material cyber security incidents, as well as the general obligation to ensure the proper risk oversight structure of cyber security as part of FirstEnergy's overall enterprise risk management program and the internal controls applicable to cyber security matters. The FE Operations and Safety Oversight Committee has primary responsibility to oversee the operational aspects of FirstEnergy's cyber security policies, programs, initiatives and strategies, as well as operational risk considerations related to cyber security matters. FirstEnergy's CISO regularly provides reports at the FE Audit Committee, FE Operations and Safety Oversight Committee, and to the full FE Board. Each such Committee and the full FE Board work collaboratively to ensure fulsome oversight with the proper focus of each respective Board body. These reports include, among other things, current and emerging cyber security risks to FirstEnergy, incidents that were escalated to management during the prior quarter, including those that did not require immediate escalation to the appropriate Committee and/or full FE Board, internal and external assessments of FirstEnergy's cyber security program, and a roadmap of projects to manage its cyber security posture.

companyName: FirstEnergy Transmission, LLC


text: Our management team takes steps to be informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Metsera, Inc.


text: Cybersecurity Threat Monitoring and Incident Response We monitor for threats to our information systems through a combination of automated intrusion detection monitoring solutions, review of log data, and other activities. We require security training for all company personnel, including instructions regarding the proper methods for reporting potential cybersecurity incidents. We also provide mechanisms for interested third parties, including security researchers and law enforcement, to provide notice of potential cybersecurity threats. In addition, we monitor third-party sources for notice of cybersecurity incidents that may affect company vendors and other parties with whom we do business.

companyName: GoDaddy Inc.

ticker: GDDY


text: The Board of Directors has formally tasked the Audit Committee with oversight responsibility to review cybersecurity and data privacy risks. The Audit Committee receives regular reports from management about cybersecurity matters. In addition to regular reporting, we have procedures by which potential cybersecurity incidents are reported in a timely manner to the Chief Technology Officer (CTO), who then notifies the Chief Executive Officer of cybersecurity incidents and they collectively determine if a specific incident warrants escalation to the Audit Committee and the Board of Directors. The acting CTO is our Executive Vice President, Chief Financial Officer, Treasurer, and Secretary, who took over responsibilities in October 2024 upon the departure of the Company's prior CTO. Our CTO manages cybersecurity at the corporate segment and oversees a team of dedicated cybersecurity personnel employed in our real estate brokerage segment, including a Chief Information Security Officer. Our governance procedures are generally designed to identify, assess, mitigate, prevent and, where required, respond to cybersecurity security incidents and threats in a timely manner to minimize the loss or compromise of information and assets and to facilitate incident resolution.

companyName: Douglas Elliman Inc.

ticker: DOUG


text: The Director of Global Information Systems has had oversight responsibilities for PLP's information systems and cyber security for 15 years. He attends regular education programs regarding enterprise cybersecurity and supporting technologies. The Director of Global Information Systems reports to the CFO and coordinates with the IT resources across all subsidiary operations to discuss risk management initiatives, testing and training, recent trends and technological developments, and periodic reviews of third-party providers.

companyName: PREFORMED LINE PRODUCTS CO

ticker: PLPC


text: Vista has an Incident Response Plan which guides the actions to be taken in the event of a suspected or confirmed cybersecurity incident. The plan includes processes to triage, investigate, contain, and remediate the incident, and is designed to enable compliance with applicable legal and regulatory obligations and mitigation of financial and reputational damage. The Incident Response Plan includes notification to the applicable members of cybersecurity leadership, including Vista's Chief Information Officer ("Vista CIO"), and, as appropriate, escalation to an internal ad-hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on the nature of the incident, the incident may also be reported to Vista's Executive Committee, as well as to our Audit Committee and to our full Board, if appropriate. Vista also maintains a Business Continuity Plan, which provides procedures for maintaining the continuity of critical business processes in the event of business interruption, including any that involve cybersecurity incidents which may materially impact operations.

companyName: VISTA CREDIT STRATEGIC LENDING CORP.


text: Incident response planning - We have an incident response plan that sets forth a structured process and approach for how we assess, respond to, recover from, and remediate cybersecurity incidents. Under the plan, our CISO, the Information Security Office, and any incident response team that may be formed, work with our legal team, our privacy office, and any other applicable internal teams and external resources to address and communicate about incidents to key stakeholders, including the Board and its Cybersecurity Committee. As part of our incident response processes, we maintain disaster recovery plans and we prepare for any required external disclosures or reporting related to cybersecurity incidents. We review and test our incident response plan from time to time through tabletop exercises and other scenario planning to enhance management and Board preparedness in the event of a potential cybersecurity incident and to identify areas of continuous improvement. We believe that our planning and related processes, reviews, and testing help minimize the potential impacts to our company from cybersecurity incidents and help us recover from them as quickly as possible.

companyName: Dynatrace, Inc.

ticker: DT


text: Our management team, including our CTO, CRCO, and CISO, has overall responsibility for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 25 years of technology and finance leadership experience across multiple industries for our CTO, over 30 years of experience in the Legal, Risk and Compliance disciplines for our CRCO, and over 20 years of cybersecurity leadership experience for our CISO.

companyName: KOHLS Corp

ticker: KSS


text: The HHH cybersecurity program is an enterprise-wide, risk-based program that is designed to support the security, confidentiality, integrity, and availability of our systems and information. We conduct periodic assessments of the cybersecurity program to identify and manage material cybersecurity threats and risks using internal teams and independent third parties. The assessment results are used to develop appropriate cybersecurity controls best practices and risk mitigation strategies, which are then implemented throughout the Company.

companyName: Howard Hughes Holdings Inc.

ticker: HHH


text: We employ various measures to help manage our cybersecurity risks, including end-to-end email encryption, two-factor authentication for access to Company applications, strong password requirements and firewall and email protection against malware and phishing campaigns. We augment these protective technologies with security monitoring and detection capabilities to limit the impact of cybersecurity incidents. Our program includes processes designed to identify material risks related to the use of third party service providers, such as cloud service providers.

companyName: SANMINA CORP

ticker: SANM


text: Our board of directors has ultimate authority and responsibility for overseeing our ERM program, including risks related to cybersecurity. Our board oversees our ERM program through the Bank's board, which meets monthly with the exception of August and November. The Bank's board reviews all minutes of the OTC and also receives a report at each meeting regarding cybersecurity risk levels and performance regarding various information security metrics.

companyName: RED RIVER BANCSHARES INC

ticker: RRBI


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risks. Periodically during each year, the Audit Committee receives an overview from our Vice President of IT of our cybersecurity threat risk management and strategy processes, including potential impact on the Company, the efforts of management to manage the risks that are identified and our disaster recovery preparations. Members of the Board of Directors regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: SEKISUI HOUSE U.S., INC.


text: Together with the MSP, we have established a written information security incident response plan that addresses the response to a cybersecurity incident, which is tested and evaluated on a regular basis.

companyName: CTO Realty Growth, Inc.

ticker: CTO


text: Cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.

companyName: EASTERN CO

ticker: EML


text: Third Party Engagements for Risk Management We engage a range of external experts, including cybersecurity consultants and auditors to support, evaluate and test our cybersecurity risk management systems. We engage a managed security service provider ("MSSP") that provides continuous threat intelligence by monitoring our network and connected devices to detect attacks and indicators of potential attacks.

companyName: Kimball Electronics, Inc.

ticker: KE


text: Consistent with NIST 800-53, our technology and cybersecurity program and controls include a third party and vendor risk management component. As part of our vendor risk management program, we conduct security assessments prior to engagement of high-risk vendors and other third-party providers and have a monitoring program to evaluate ongoing compliance with our cybersecurity standards.

companyName: BIOGEN INC.

ticker: BIIB


text: The Audit and Risk Committee receives at least quarterly reports from our Chief Information Officer on our information technology and cyber risk profile, enterprise cyber program, key enterprise cyber initiatives, and significant updates on external audits of our information security program.

companyName: MATERION Corp

ticker: MTRN


text: Our management is responsible for the Company's day-to-day risk operations and management processes. Management has established cybersecurity standards to improve the Company's cybersecurity risk posture and to help define and implement appropriate measures to protect the Company's systems and data from cyber threats. In addition to our Internal Audit and Compliance functions, the ERM team partners with various front-line risk teams and risk owners across Robinhood, to foster consistent risk management practices across Robinhood. In particular, the ERM team provides governance over risk management practices and reports on a quarterly basis on top risks to the Safety Committee, along with planned mitigants and monitoring procedures.

companyName: Robinhood Markets, Inc.

ticker: HOOD


text: The consideration of cybersecurity threats are integrated into our overall risk management program. We engage external consultants who are experts in the field of cybersecurity and meet at regular intervals to evaluate current conditions and address any cybersecurity threats accordingly. We also provide continuous training to our employees regarding the risks related to cybersecurity. We are not aware of any risks from cybersecurity threats that have materially affected our business strategy, results of operations, or financial condition. Governance.

companyName: SenesTech, Inc.

ticker: SNES


text: We engage third parties, including vendors and other external service providers, to support our cybersecurity and data privacy processes. For example, we regularly engage independent third parties for penetration testing and evaluation of our various security compliance standards. We also conduct internal assessments of our cybersecurity risk management program. We review and update our cybersecurity policies, standards and procedures as needed, to account for changes in the threat and operational landscapes, as well as in response to legal and regulatory developments. Our team has established a continuous improvement process through which we regularly update our risk register against the evolving capabilities of adversaries and incorporate findings from internal and external testing. Further, we require mandatory training for all employees and contractors on our cybersecurity and privacy policies. We also have processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. To that end, we maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, we perform diligence on our vendors and prospective vendors regarding their cybersecurity posture. Although we have continued to invest in our diligence, onboarding, and monitoring capabilities over our critical third parties, including our third-party vendors and service providers, our control over the security posture of our critical third parties is limited, and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information assets owned or controlled by such third parties.

companyName: SentinelOne, Inc.

ticker: S


text: Our Chief Financial Officer has overall responsibility for our cybersecurity and has over 20 years of experience managing information technology, or IT, departments at biotechnology and pharmaceutical companies. Our Senior Director of Information Technology is responsible for the development and implementation of IT department controls, policies, infrastructure, and day-to-day operations, in addition to managing security risk, evaluating safeguards and recommending security improvements, and has over seven years of experience managing IT departments for a biotechnology company. We utilize third-party vendors to help strengthen our information security risk management by conducting evaluations of our security controls on at least a quarterly basis.

companyName: Altimmune, Inc.

ticker: ALT


text: Our cybersecurity strategy includes considerations around incident detection and response. We maintain a current cybersecurity incident response plan to prepare for, detect, respond to, and learn from cybersecurity incidents. The incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management. Additionally, we have engaged a leader in third-party security solutions to conduct periodic technical and management tabletop exercises to assist in preparing for and responding to cybersecurity incidents. These preparedness exercises are intended to provide hands-on training for the participants and helps us to assess our processes and capabilities in addressing cybersecurity threats. We maintain documented incident response protocols to ensure immediate and consistent application of our processes in the event of an incident. Management and the Board of Directors are apprised of cybersecurity incidents deemed to have a moderate or higher impact to our business, even if the event is ultimately determined to be immaterial.

companyName: HireRight Holdings Corp


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. See Item 1A of Part 1 – "Risks Related to our Business and Operations – Information Technology, Cybersecurity and Intellectual Property" for additional information on risks related to cybersecurity threats.

companyName: Verano Holdings Corp.

ticker: VRNO


text: Our CSMS uses third-party software to identify and prioritize cybersecurity threats and has dedicated personnel whose core responsibilities are to document and track cybersecurity threats. We use security technology tools and methodologies to protect our information systems. We also use tools for risk and vulnerability management and perform periodic penetration testing and vulnerability scanning. Further, we provide our employees information security awareness training upon hire and annually thereafter.

companyName: ANSYS INC


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents in the past three fiscal years, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Presurance Holdings, Inc.

ticker: PRHI


text: We are a special purpose acquisition company with no business operations. Since the IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not believe that we currently face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since the IPO.

companyName: INTEGRATED RAIL & RESOURCES ACQUISITION CORP


text: We rely on certain third-party computer systems and third-party service providers in connection with providing some of our services. These third-party business partners, service providers, and consultants need to access our customer and other data, and connect to our computer networks. We define expected security and privacy requirements through our contracting processes with those third parties and we perform cyber risk assessments at the time of procurement to review the cyber risk management efforts of those third parties. These vendors are contractually obligated to notify us when they experience a cybersecurity incident that can affect our operations or stakeholders.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: The Board, in coordination with the Adviser, oversees the Company's risk management program, including the management of cybersecurity threats. The Board receives regular updates and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by the Company'. The Board also receives prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Adviser discuss the Company's approach to overseeing cybersecurity threats.

companyName: Kayne Anderson BDC, Inc.

ticker: KBDC


text: Cybersecurity is an important aspect of our business operations, and we are committed to protecting our systems, data, and the information of our clients and stakeholders. We recognize that cybersecurity threats are constantly evolving and that maintaining robust security measures is an ongoing process. Below is an overview of our cybersecurity risk management and the measures we have in place:

companyName: INTERLINK ELECTRONICS INC

ticker: LINK


text: The Company has established a cybersecurity program intended to protect our information assets and those information assets of our clients that come under our control. Our cybersecurity risk management processes include technical security controls, monitoring systems, operational processes and policies, and management oversight to assess, identify and manage risks from cybersecurity threats. We have implemented risk-based controls to protect our information, information systems and business operations. We have adopted security-control principles and standards based on the National Institute of Standards and Technology Cybersecurity Framework (NIST), other recognized global standards and client contractual requirements, as applicable. We strive to evaluate and invest in technology, personnel and infrastructure to maintain cybersecurity measures in line with our risk exposure and to address the ever-changing threat, technology and regulatory landscape.

companyName: Cushman & Wakefield Ltd.

ticker: CWK


text: We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. Our Chief Technology Officer, reporting to the Chief Executive Officer, is primarily responsible for addressing these risks. We devote appropriate resources and designate members of our management to address the risk assessment and mitigation process.

companyName: La Rosa Holdings Corp.

ticker: LRHC


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of our business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. See Item 1A. "Risk Factors" for more information on cybersecurity risks.

companyName: REMARK HOLDINGS, INC.

ticker: MARK


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: dedicated cybersecurity staff, including a 24X7 security operations center monitoring for and responding to threat activity, incident response plans and processes, vulnerability management, secure software development, static and dynamic code scanning for vulnerabilities, open-source software scanning, internal and third-party penetration testing, a bug bounty program, internal audit and assurance of security controls, disaster recovery/business continuity plans, attainment and maintenance of industry-standard security certifications, identity and access management, asset management, tracking and disposal, encryption, access controls, third-party risk management, phish testing and reporting, employee security awareness training, and maintaining cybersecurity insurance.

companyName: Freshworks Inc.

ticker: FRSH


text: The Company recognizes the critical importance of maintaining the trust and confidence of our clients, business partners, and employees, and has developed an information security program to address material risks from cybersecurity threats. We have implemented a cross-functional approach to preserving the overall integrity of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to security incidents when they occur, while also maintaining controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: Our senior leadership team, which includes Mr. Austin and Ms. Hodges, has established a risk management framework to actively manage, mitigate and report on the various risks faced by Oncor. Pursuant to that framework, as frequently as necessary, but not less than quarterly, our chief risk officer, members of our senior leadership team and additional members of management meet to review and assess various operational, functional, legal and other types of risks facing the company, including risks related to cybersecurity. Discussions at these risk management forums include mitigation strategies and actions to provide oversight and assign responsibility for ongoing treatment and monitoring each specific risk. Risk management information collected at these meetings is then distributed at least quarterly to the Audit Committee of our board of directors as well as our full board of directors. In addition, our chief risk officer reports on these risk management efforts, including risks related to cybersecurity, to the Audit Committee and/or the full board of directors at least quarterly. In addition, Mr. Austin and Ms. Hodges also provide separate written reports on cybersecurity risks and activities to both the Audit Committee and the full board of directors, with specific discussion time devoted to cybersecurity at the Audit Committee and/or the full board of directors at least quarterly.

companyName: ONCOR ELECTRIC DELIVERY CO LLC