text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance," Apollo's Board of Directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer ("CISO") and the Chief Information Security Officer of Athene Holding Ltd. ("AHL's CISO"), a subsidiary of Apollo, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, and also receive support, as appropriate, from our executive officers and other representatives of the Adviser and its affiliates. • Collaborative Approach. Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with our management and our Board, as applicable, in a timely manner. • Technical Safeguards. Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.

companyName: Apollo Debt Solutions BDC


text: We have experienced cybersecurity incidents of varying degrees on our information technology; however, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operation or financial condition. However, we cannot eliminate all risks and the compromise or interruption of, or damage to, our information technology (including our operational technology and websites) by cybersecurity incidents could have a material negative impact on our business. For a more detailed discussion of the risks, see Risks related to Technology and Cybersecurity Matters within Item 1A. Risk Factors.

companyName: ESTEE LAUDER COMPANIES INC

ticker: EL

secItem: Item 1C


text: The Corporation recognizes that our overall security culture contributes to the effectiveness of our ISP. The Corporation maintains an enterprise risk management program that identifies, prioritizes and provides a formal structure for the internal and external risks that impact the organization. The Board of Directors sets the tone and direction for the Corporation's use of IT and has identified the Audit Committee as having primary responsibility for oversight of the Corporation's risk exposures and risk assessments and policies, including risks related to cybersecurity. The Board of Directors and Audit Committee approve and periodically review and re-approve the ISP and other IT related policies. While the Board of Directors may delegate the design, implementation, and monitoring of certain IT activities to the CIO or designee, the full Board of Directors remains responsible for overseeing IT strategies and policies, including cybersecurity. To help carry out their responsibilities, Directors, management, and all employees are periodically trained to understand IT activities and risks, including cybersecurity risks. Management, via the Systems and IT Steering Committee and ISO, or combination, provides a status report to the Board of Directors at least annually, with more frequently communications as necessary. The report describes the overall status of the ISP and material matters related to the program, including security breaches, cybersecurity assessments, cybersecurity awareness training for employees and the Board of Directors and results of incident response testing.

companyName: C & F FINANCIAL CORP

ticker: CFFI


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's board of directors, primarily through its audit committee. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company conducts security assessments of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company engaged a third party consulting firm to evaluate and test the Company's risk management systems and to assess and remediate potential cybersecurity incidents as appropriate, which work is ongoing.

companyName: MARIMED INC.

ticker: MRMD


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors and consultants in evaluating and testing our risk management systems. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties include regular monitoring, threat assessments, and consultation on security enhancements. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.

companyName: TANGER PROPERTIES LTD PARTNERSHIP /NC/


text: As discussed in more detail under the heading "Governance," The Board of Directors' oversight of cybersecurity risk management is led by the Audit Committee of the Board of Directors (the "Audit Committee"), which interacts quarterly with the Company's ERM function, the Company's Chief Information Security Officer ("CISO"), other members of management and relevant management committees and councils.

companyName: Kontoor Brands, Inc.

ticker: KTB


text: Our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected, we, through our Adviser and Administrator, consults with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: • implementation of industry leading Cloud solutions and business applications which possess integrated cybersecurity safeguards; • anti-malware, antivirus and threat detection software; • ransomware containment and isolation software; • enhanced password requirements and multifactor authentication requirements; • endpoint encryption; • intrusion detection and response system conduct file integrity monitoring; • email archiving, firewalls, and quarantine capabilities; • mobile device management of business applications; • frequent systems backups with recovery capabilities; and • regular vulnerability scans and penetration testing.

companyName: GLADSTONE INVESTMENT CORPORATION\DE

ticker: GAIN


text: Cybersecurity risk is a part of our overall enterprise risk management assessment. Our cybersecurity program is modeled on the National Institute of Security Technology Cybersecurity Framework (NIST CSF) which provides the governance structure for our identification of, protection against, detection of, response to and recovery from cybersecurity threats and incidents, including those associated with our use of third-party applications and service providers.

companyName: MASCO CORP /DE/

ticker: MAS


text: We rely on our information technology to operate our business. We have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident. We seek to mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We plan to engage a third-party consultant to assist us with designing controls and our cybersecurity risk management framework. We have not encountered cybersecurity threats or incidents that have had a material impact on our business.

companyName: Maison Solutions Inc.

ticker: MSS


text: IT leadership is made up of senior managers with the appropriate qualifications and business experience required for their roles across Innospec's IT operations. The Company considers that the IT leadership team is sufficiently experienced and qualified in its role of assessing and managing cyber security risks across the business. IT leadership formally reports through the CEO and CFO to the Board.

companyName: INNOSPEC INC.

ticker: IOSP


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • our IT team, in coordination with senior management, is principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and designed to anticipate cyber-attacks and prevent breaches; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a risk management process for third parties, including, but not limited to service providers, suppliers, and vendors.

companyName: Global Net Lease, Inc.

ticker: GNL


text: We consult recognized security frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework to organize, improve, and assess our IT/OT Security Program to manage and reduce cybersecurity risk. We deploy, configure, and maintain various technologies designed to enforce security policies, detect and protect against cybersecurity threats, and help safeguard IT and OT assets. We operate a Cybersecurity Operation Center (CSOC) to ingest threat intelligence, monitor cybersecurity threats, coordinate incident response resources and manage response times.

companyName: CONOCOPHILLIPS

ticker: COP


text: We rely on Cheniere's cybersecurity leadership team, which consists of its Director and Chief Information Security Officer ("CISO"), Vice President and Chief Information Officer and Senior Vice President of Shared Services. These individuals collectively provide the strategic oversight of our cybersecurity governance, cyber risk management and security operations and are responsible for maintaining our technology defense posture and program. They have decades of experience managing strategic technology operations, including the identification of cybersecurity risk and the defense of information technology assets from global threats. Cheniere's CISO's experience includes assessing risks, implementing governance programs, and responding to threats in oil and gas, electric and natural gas utilities and nuclear power generation companies. He maintains a Certified Information Security Manager certification from ISACA, secret clearance from the Department of Homeland Security and has played an active role in the development of various cybersecurity standards including the CSF.

companyName: Cheniere Energy Partners, L.P.

ticker: CQP


text: Both our CISO and other members of our cybersecurity leadership team participate in threat intelligence briefings provided by various government and industry entities. Moreover, our Executive Vice President – Chief Digital and Information Officer and Chief Transformation Officer is a member of the FedEx Executive Committee, which oversees our business risk, with cybersecurity threat risks being a regular topic of discussion. Our cybersecurity incident response plan includes processes for communicating cybersecurity incidents to relevant levels of management, including the ITRC, Executive Committee, the CyTOC, and the full Board of Directors, as appropriate.

companyName: FEDEX CORP

ticker: FDX


text: The Company's information technology systems and processes are assessed by independent third parties, as appropriate to their business requirements, for compliance with the following standards: HIPAA; NIST 800-53; System and Organization Controls ("SOC") 1; SOC 2 Type 2; HI-TRUST; Payment Card Industry Data Security Standards; and the National Association of Insurance Commissioners. The Company annually purchases a cybersecurity risk insurance policy that would help defray the costs associated with a covered cybersecurity incident if it occurred.

companyName: CVS HEALTH Corp

ticker: CVS


text: VF's IT systems have been subject to cybersecurity incidents in the past, including the previously disclosed December 2023 cybersecurity incident (the "Cyber Incident"). We believe the impacts of the Cyber Incident were not material to VF's financial condition or results of operations. In addition, we do not believe that risks from cybersecurity threats have materially affected VF's business strategy, financial condition, or results of operations. However, there is no guarantee that future cybersecurity incidents will not have a material impact in the future. Furthermore, processes designed to manage cyber risks, including those described herein, may not be effective. To learn more about risks from cybersecurity threats, as well as risks from the Cyber Incident, see the following risk factors in Item 1A of this Part I, under the headings, "VF relies significantly on information technology. Any inadequacy, interruption, integration failure or security failure of this technology could harm VF's ability to effectively operate its business," "VF is subject to data and information security and privacy risks that could negatively affect its business operations, results of operations or reputation," and "We experienced a significant data security breach in December 2023 which could result in a number of potentially unknown outcomes, including but not limited to, litigation, regulatory investigations or enforcement actions, or reputational harm, any of which could have a material impact on our business operations, financial condition, or results of operations." Additional risks and uncertainties not currently known or that may currently be deemed to be immaterial also may materially adversely affect VF's business strategy, financial condition, or results of operations. VF is seeking reimbursement of costs, expenses and losses stemming from the Cyber Incident by submitting claims to VF's cybersecurity insurers. The timing and amount of any such reimbursements are not known at this time.

companyName: V F CORP

ticker: VFC


text: The Enterprise Technology Risk Committee provides business unit oversight of key management activities, including the Company's Information Security Program. The Technology Risk Oversight Committee provides oversight of key risk management activities to identify, assess, monitor, mitigate, and report on technology (including core technology, data and cybersecurity) risk across the enterprise. These sub-committees serve as governing forums for monitoring and escalating significant cybersecurity as well as other technology risk matters to the ERC.

companyName: TRUIST FINANCIAL CORP

ticker: TFC


text: Under the Security Incident Response Policy, all EVgo employees and other personnel are responsible for reporting any known, suspected or possible security events, including those that may have originated with a third-party service provider, to the Company's Information Security Department, which promptly notifies the Company's President, who serves as the Company's Information Security Coordinator. The Information Security Coordinator reviews the initial facts and findings regarding any security events, provides direction to the Information Security Department regarding any additional information that should be obtained, and convenes a meeting of the Company's Security Incident Response Team (the "SIRT") to review the matter, including to determine if the event could constitute a security incident.

companyName: EVgo Inc.

ticker: EVGO


text: Based on our assessment process, we implement and maintain various technical, physical, and organizational measures designed to manage and mitigate cybersecurity risks and potential material impacts. Depending on the environment or systems, we implement measures designed to prevent, detect, respond to, mitigate, and recover from identified and significant cybersecurity threats. The risk management and reduction measures we implement for certain of our environments or systems include: policies and procedures designed to address cybersecurity threats, including an incident response policy, acceptable use policy, and vulnerability management policy; internal and/or external audits of some environments to assess our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; encryption of certain data; network security controls in certain systems; physical and electronic access controls in certain environments; asset management, tracking and disposal; systems monitoring of certain systems; employee security training; penetration testing of certain environments; and maintaining cyber insurance; and a dedicated cybersecurity officer.

companyName: Dutch Bros Inc.

ticker: BROS


text: c. Utilize third-party systems and processes that continually monitor our systems to prevent, detect and remediate cyber security threats and events; d. Conduct annual cybersecurity management training for employees with access to our systems and processes that handle sensitive data;

companyName: Independence Contract Drilling, Inc.


text: Risk assessments Our Information Security Team, led by our Chief Information Security Officer ("CISO"), consists of a Cybersecurity function and a Governance, Risk and Compliance function, and is constantly monitoring for cybersecurity risks and assessing any such risks' potential severity. This team employs a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing and tabletop exercises to inform the company of potential risks and mitigation strategies. We also execute an annual enterprise risk management assessment, which includes cybersecurity threat risks in addition to other risk areas that could impact the company.

companyName: TrueBlue, Inc.

ticker: TBI


text: We take a layered approach to cybersecurity leveraging multiple levels of controls designed to mitigate and minimize cybersecurity risks and protect the confidentiality, integrity, and availability of our critical systems and information. We have established and implemented policies and processes designed to assess, identify, and manage risks from cyber security threats, including product and SaaS security, and have integrated these into our operating model and enterprise risk management processes. We monitor for, and assess, material risks from cyber security threats such as unauthorized occurrences or events on or conducted through our information systems that may result in adverse effects to the confidentiality, integrity, or availability of our information systems or information, including personal information, proprietary information and intellectual property.

companyName: Life360, Inc.

ticker: LIF


text: As part of our cybersecurity risk management process, we conduct "tabletop" exercises during which we simulate cybersecurity incidents to ensure that we are prepared to respond to such an incident and to highlight any areas for potential improvement in our cyber incident preparedness. In addition, all employees are required to complete a mandatory cybersecurity training course on an annual basis and receive monthly phishing simulations to provide "experiential learning" on how to recognize phishing attempts.

companyName: BOEING CO

ticker: BA


text: We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. We employ systems and processes designed to oversee, identify and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. Despite ongoing efforts to continuously improve our holistic ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, disruption of our business operations, revenue and client loss, legal actions, or statutory penalties, among other consequences.

companyName: ESAB Corp

ticker: ESAB


text: Management's Roles and Responsibilities Our cybersecurity response is handled by our information security team and managed by our Chief Information Security Officer (CISO), who reports to the Chief Financial Officer. Our CISO has over thirty years of business and technical experience in information risk, risk management, and regulatory compliance, including thirteen years in a CISO role. Our information security team manages risks by establishing policies and procedures that manage information system access appropriately. These policies and procedures are tested through internal exercises and with external assistance and supplemented by training and communication to our employees and subcontractors.

companyName: MAXIMUS, INC.

ticker: MMS


text: We have not been the victim of a cyber incident in the past but may be the subject of cyber incidents in the future. See Item 1A, Risk Factors for more information about the risk posed to us by cybersecurity threats.

companyName: Edible Garden AG Inc

ticker: EDBL


text: The Company's business strategy, results of operations and financial condition have not been materially affected and are not reasonably likely to be affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but it cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on the Company's information technology related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.

companyName: FRANKLIN ELECTRIC CO INC

ticker: FELE


text: Board continues to oversee management's identification and management of cybersecurity risks. The Audit Committee of the Board (the "Audit Committee") is responsible for cybersecurity risk oversight and meets at least annually with management to review risk assessments, ongoing initiatives, and key learnings from incidents. In 2024, the Audit Committee adopted enhanced reporting protocols to ensure timely and transparent updates on cybersecurity matters.

companyName: Vislink Technologies, Inc.

ticker: VISL


text: Cross-Functional Approach: BlackRock has implemented a global, cross functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks.

companyName: iShares Silver Trust

ticker: SLV


text: At the management level, our cyber program is managed by our ICSP group. The ICSP group consists of Information Technology (IT) managers, IT security subject matter experts, and internal audit personnel and is led by our Vice President of IT who has more than 25 years of experience in IT, enterprise security and cyber risk management, a Bachelor's degree of Science, CIS, Information Technology and Master's of Business, Information Systems, and holds Certified Information Systems Security Professional, Certified Information Security Manager and Certified Data Privacy Solution Engineer designations. The ICSP group is in charge of developing, maintaining and measuring compliance with the information and cybersecurity governance program, as well as monitoring cyber incidents and implementing mitigation measures as part of an evolving, dynamic external environment. Our approach to cybersecurity incident reporting and response planning is governed by our incident response plans established for each of our business units. The plans outline the processes related to detecting, assessing, investigating, mitigating and remediating cyber incidents, as well the communication and reporting plan and the required personnel to be included in the process and communications.

companyName: Otter Tail Corp

ticker: OTTR


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, among others: • periodic comparison of our processes to standards set by the National Institute of Standards and Technology; • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • undertake an annual review of our consumer-facing policies and statements related to cybersecurity; • conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • conduct annual cybersecurity training for all employees and contractors, along with targeted training on a quarterly basis for specific subsets of employees identified through our phishing simulations; • through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • conduct regular network and endpoint monitoring and vulnerability assessments to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K; • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; • conduct vulnerability scans and leverage the scan results to continuously patch and manage our network as new threats emerge; and • constant active monitoring by our contracted Security Operations Center.

companyName: Marcus & Millichap, Inc.

ticker: MMI


text: As part of our cybersecurity program, we regularly test our cyber defenses by performing simulations and drills at a technical level, internal user susceptibility testing and reviewing our operational policies and procedures. Our cyber security team monitors alerts and meets to discuss threat levels, risk ranking, trends and remediation. We conduct security assessments on additions and changes to our systems and applications including third-party service providers. In addition, our Audit Services group conducts periodic reviews of cyber security controls, procedures, and applications and monitors remediation activities. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: Fossil Group, Inc.

ticker: FOSL


text: Index to Financial Statements Our Chief Corporate Architect is responsible for day-to-day identification, assessment and management of the information security risks we face. Our Chief Corporate Architect studied computer science at Carnegie Mellon University and has been with Oracle since 1986 in a number of positions. In his current role as Chief Corporate Architect, he drives technology and architecture decisions across all Oracle products and leads companywide strategic initiatives, including with respect to industry standards and security, to ensure that product development is consistent with Oracle's overall long-term strategy.

companyName: ORACLE CORP

ticker: ORCL


text: c. Assigning all data within Westwood to an appropriate owner, and ensuring data owners have knowledge of such data and have an information classification selected for that data; d. Ensuring annual compliance with our information security management policies and procedures;

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: Under the oversight of the audit committee of the Board, and as directed by our Chief Executive Officer ("CEO") and Chief Operating Officer ("COO"), the Head of IT is primarily responsible for the assessment and management of material cybersecurity risks and the Company's annual security audits to meet the payment industry expectations. Our management team holds a regular cybersecurity and business continuity reviews to evaluate data security exposures, control effectiveness and necessary remediation actions. The Head of IT is also supported by a third-party IT consulting services provider who helps oversee our IT systems and provides cross-functional support for cybersecurity risk management and facilitates the response to any cybersecurity incidents.

companyName: RYVYL Inc.

ticker: RVYL


text: If applicable, identify any board committee or subcommittee responsible for the oversight of risks from cybersecurity threats and describe the processes by which the board or such committee is informed about such risks.

companyName: Energy & Water Development Corp

ticker: EAWD


text: While we face a variety of cybersecurity risks, such as phishing attempts, ransomware attacks, account takeovers, fraudulent orders, and unauthorized access attempts, such risks have not materially affected us to date, including our business strategy, results of operations or financial condition, and we do not believe such risks are reasonably likely to have such an effect over the long term. For more information about the cybersecurity risks we face, see "Item 1A – Risk Factors - Our reputation and business may be harmed if our or our vendors' computer network security or any of the databases containing customer, employee, or other personal information maintained by us or our third-party providers is compromised, which could materially adversely affect our results of operations."

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: deployment of updates and patches as they are available and maintaining the current versions of major software to reduce the exposure the use of third-party service to conduct mandatory online training for all employees regarding identifying and avoiding cyber-security the review of the security procedures used by third parties that may host or otherwise have access to Fuel Tech's data.

companyName: VIVIC CORP.

ticker: VIVC


text: Our cybersecurity program is based on the National Institute of Standards and Technology Cybersecurity Framework and is designed to ensure that our information systems are effective and are prepared for cybersecurity threats, including through regular oversight and mitigation of internal and external threats. As a U.S. defense subcontractor, we are additionally obligated to comply with Department of Defense regulations such as Defense Federal Acquisition Regulation Supplement.

companyName: BUTLER NATIONAL CORP

ticker: BUKS


text: The Company's cybersecurity risk management practices are intended to assess, identify and manage risks from threats to the security of our information, systems, products and network. We have developed and implemented cybersecurity and data privacy processes and procedures that are informed by recognized cybersecurity frameworks and standards, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and International Organization for Standardization 27001 (ISO 27001) Framework. We use these frameworks, together with information collected from assessments, to tailor aspects of our cybersecurity and data privacy practices given the nature of our assets, operations and business. Key features of our cybersecurity and data privacy processes and procedures include the following: • Risk-based controls for information systems and information on our networks: We seek to maintain an information technology infrastructure that implements controls that are tailored based on risk and designed to protect the confidentiality, integrity and access to our information systems and information stored on our networks, including member, customer and employee information, intellectual property and proprietary information. We employ in-depth defense mechanisms throughout our enterprise, including, but not limited to, employee training, vulnerability management, multi-factor authentication, cybersecurity insurance and managed security services to monitor, mitigate and/or prevent cybersecurity incidents. • Cybersecurity incident management and response: We have a cybersecurity incident response plan and specified teams to respond to cybersecurity incidents. When a cybersecurity incident occurs or we identify a vulnerability, our cross-functional teams lead the initial assessment of priority and severity, and external experts may also be engaged as appropriate. Our cybersecurity teams assist in responding to incidents depending on severity levels and seek to improve our cybersecurity incident management plan through periodic simulations of common incidents. Further, we work closely with our external managed security services experts to provide ongoing monitoring and to augment our internal cybersecurity team with incident management and response specialists. • Cybersecurity awareness and training: Our employees are required to complete security awareness training and a compliance course annually, which we believe helps our employees understand their information protection and cybersecurity responsibilities. We also provide additional training to certain employees in accordance with member or customer requirements and regulatory obligations. Further, we regularly communicate with employees about evolving cybersecurity trends through company-wide cybersecurity alerts, which heightens awareness of cybersecurity events that may be impacting our business, peers and industry. • Our assessments of third parties: We have implemented a third-party risk management process that includes, among other things, periodic cybersecurity assessments on certain third parties on which we rely based on an assessment of their risk profile. We also seek contractual commitments from third parties to satisfy our cybersecurity and data privacy requirements, and require third parties to maintain their information technology systems and protect Wheels Up information that is processed on their systems.

companyName: Wheels Up Experience Inc.

ticker: UP


text: While our Board of Directors (the "Board") has overall responsibility for risk oversight, the Audit Committee of the Board (the "Audit Committee") oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, monitoring, reporting and, where appropriate, providing recommendations to the Board regarding compliance with our internal policies and its progress in remedying any material deficiencies, including those related to our security policies, including the physical safeguarding of corporate assets and security of our networks and information systems. The Audit Committee receives periodic updates regarding the cybersecurity program, including top threats and risks, and updates on the cybersecurity roadmap.

companyName: Grace Therapeutics, Inc.

ticker: GRCE


text: Our polices and processes address cybersecurity threat risks associated with the use of third -party service providers, including those who access, use and/or store our client, candidate, associate and employee data or have access to our network and systems. Third-party risks are included within our enterprise risk management assessment program, as well as our information security-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third -party service providers. We perform due diligence on third parties that have access to our systems, data or facilities that house such systems or data. This allows us to identify high-risk providers and continually monitor for cybersecurity threat risks appropriately. Additionally, we require contracts with all third parties that have access to our network and systems to include baseline security requirements for adequate data handling, as well as to provide the company with audit rights. Such contractual requirements are reviewed during each subsequent contract renewal process.

companyName: HireQuest, Inc.

ticker: HQI


text: Our ISO is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense program. This endpoint program is monitored 24/7 and would notify IT staff of an incident. Most incidents would be mitigated by monitoring staff of the endpoint program, but IT staff would have to be involved in more severe incidents. This mitigation is resolved from an always updating database. In severe cases, the device that triggers the incident would be locked down and a plan of action would be put in place. The second line of defense is a monitored firewall. This would also notify IT staff of an incident. Last line of defense is IT Staff. The department is augmented by an information security specialist that is on a monthly retainer. Individuals within the department are generally subject to professional education requirements.

companyName: Southern States Bancshares, Inc.


text: During the fiscal year ended June 30, 2025, the Company did not identify any cybersecurity incidents that had a material impact on our business strategy, results of operations, or financial condition, and no incidents were determined to be material individually or in the aggregate.

companyName: INTERGROUP CORP

ticker: INTG


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Risk Management Steering Committee and the Audit Committee, and we evaluate potential adjustments to our cybersecurity policies, standards, processes and practices as reasonably necessary based on the information provided by these assessments, audits and reviews. We also provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: Vizio Holding Corp.


text: We rely on our management and third-party service providers, as described further below, to manage any perceived cybersecurity threats and risks. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including incident detection and response, internal controls within our accounting and financial reporting functions, network security controls, access controls, physical security, systems monitoring, and employee training.

companyName: Medalist Diversified, Inc.

ticker: MDRR


text: We have not identified risks from known cybersecurity threats, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Galaxy Gaming, Inc.

ticker: GLXZ


text: The CISO is responsible for assessing and managing material cyber risks. The CISO's expertise with assessing and managing material cyber risks is based on more than 20 years of cybersecurity experience with prior roles as a CISO and Global Head of Operations. The CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity by the ECSO through regular reporting and escalations, as required. The CIOO, the CISO, and others, report information about material risks from cybersecurity threats to the Board or a committee or subcommittee of the Board, as described below.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: In the ordinary course of our business, we and our third-party service providers collect, maintain and transmit sensitive data on our networks and systems, including with respect to our intellectual property and proprietary or confidential business information (such as research data and personal information). The secure maintenance of this information is critical to our business and reputation. In addition, we are dependent on the functioning of our information technology infrastructure to carry out our business processes. While we have adopted administrative, technical and physical safeguards to protect such systems and data, our systems and those of third-party service providers may be vulnerable to a cyber-attack.

companyName: Finch Therapeutics Group, Inc.

ticker: FNCH


text: Managing Material Risks & Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: CORETEC GROUP INC.

ticker: CRTG


text: The Program governs all FLIAC internal systems, as well as third parties providing service to the Company, and is based on the following five pillars: • Identify - The first pillar of the Program is to identify the organization's critical assets, vulnerabilities, and potential threats. This involves conducting a thorough quantitative and qualitative risk assessment and asset inventory based on the organization's information systems, data repositories, and network infrastructure. Additionally, it involves categorizing and classifying the importance of different assets, assessing their potential impact on the organization if compromised, and identifying applicable regulatory compliance requirements. • Protect - After identifying the assets and vulnerabilities, FLIAC applies comprehensive asset protection methods allowing for accurate risk mitigation techniques. This includes deploying a range of security controls such as firewalls, intrusion detection systems, antivirus software, encryption mechanisms, and access controls. The goal is to establish multiple layers of defense to prevent unauthorized access, data breaches, cyber-attacks, and other cybersecurity incidents. Employee awareness training and secure coding practices also fall under this component to ensure a culture of security throughout the Company. • Detect – The Program focuses on the timely detection of any suspicious activities or security breaches. This involves implementing security monitoring systems, intrusion detection systems, and log analysis tools to continuously monitor network traffic, system logs, and user behavior. Real-time alerts and security incident management processes help in identifying potential security incidents promptly. • Respond – If a security incident is detected, a response plan is triggered to minimize the impact and contain the threat. This component involves establishing an incident response team and defining incident response procedures. The team is trained to respond promptly, investigate the incident, mitigate the damage or harm, and restore normal operations. Communication plans, legal considerations, regulatory requirements, and coordination with external entities, like regulators, law enforcement, vendors and other key stakeholders, are also part of the response process. • Recover - The final pillar of the Program focuses on recovering from a security incident and restoring normal operations. This includes activities such as system restoration, data recovery, and analyzing the incident to identify lessons learned and improve future incident response capabilities. It also involves assessing residual risks, updating security controls, and continuously monitoring and testing the Company's security posture to ensure readiness for potential future incidents.

companyName: FORTITUDE LIFE INSURANCE & ANNUITY CO


text: We maintain a cybersecurity risk management program designed to mitigate cybersecurity risks through a comprehensive framework that integrates cybersecurity into our overall risk management processes.

companyName: EVgo Inc.

ticker: EVGO


text: For the year ended December 31, 2024, we are not aware of any material cybersecurity incidents. While we have not, as of the date of this annual report on Form 10-K, experienced a cybersecurity threat or incident resulting in a material adverse impact to our business or operations, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. There can be no guarantee that we will not experience such an incident in the future. We maintain cybersecurity insurance coverage that provides protection against losses arising from certain cybersecurity incidents. In addition, we seek to detect and investigate unauthorized attempts and attacks against our network, products, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our products and services; however, we remain potentially vulnerable to known or unknown threats.

companyName: Celularity Inc

ticker: CELU


text: While we have experienced cybersecurity threats in the past in the normal course of business and expect to continue to experience such threats from time to time, to date, none have had a material adverse effect on our business, financial condition, results of operations or cash flows. Even with the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors - Operational Risks - Disruptions or breaches of our information systems could adversely affect us" for a discussion of cybersecurity risks.

companyName: BALCHEM CORP

ticker: BCPC


text: Layered security controls monitoring traffic to and within the Company that identify and block suspicious activity, with system configurations that align with industry best practices. Preventative and detective controls to identify adverse internal and external trends and analyze the Company's response mechanisms.

companyName: National Bank Holdings Corp

ticker: NBHC


text: The Company also conducts ongoing cyber security reviews which includes updates on the Company's enterprise cybersecurity risk and product cybersecurity risk. Risk is assessed utilizing internal key performance indicators and external evaluations to determine the Company's cybersecurity score in comparison to its peer group. Wabtec's Board of Directors participates in all enterprise annual security awareness training and phishing campaigns. Throughout the year, as appropriate, in addition to regularly scheduled updates, the Audit Committee, CIO, and CISO maintain an ongoing dialogue regarding the Company's cybersecurity risk and posture. The cybersecurity framework is also supported by Wabtec's broader enterprise risk management process to ensure alignment of the Company's cybersecurity efforts with the Company's overall enterprise risk management.

companyName: WESTINGHOUSE AIR BRAKE TECHNOLOGIES CORP

ticker: WAB


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident.

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO


text: Identification, Assessment, and Management of Third-Party Cybersecurity Risks We have designed our risk identification, assessment, and management processes and procedures to account for cybersecurity risks associated with our use of third-party service providers. In addition to performing periodic assessments of vendors that include evaluating those vendors for cybersecurity risks, we endeavor to reduce supply chain cybersecurity risks by: (1) seeking to impose contractual requirements on our counterparties related to the use and security of personal data and other confidential information, as well as compliance with applicable privacy and security laws, wherever required by law to do so; and (2) requiring new software integrations and connectivity with vendors to undergo an architectural review process that involves consultation with the information security function and other relevant stakeholders. Moreover, critical vendors receive periodic comprehensive risk assessments conducted by the vendor management office (a team within ERM), in collaboration with Information Security and our Business Resiliency Governance ("BRG") team, that include a focus on the vendor's cybersecurity practices.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: CMS Energy's and Consumers' cybersecurity program focuses on finding and remediating vulnerabilities in their systems. The companies use third-party firms for penetration testing, audits, and assessments, and conduct technical exercises to practice their response to simulated events as well as tabletop exercises to test that response using their incident command system, including leadership decisions. The companies also have a dedicated, proactive function focused fully on monitoring CMS Energy's and Consumers' systems and responding when cybersecurity attacks occur. This includes regular information sharing with industry partners, peer utilities, and state and federal partners. The companies' incident response plan outlines the individuals responsible, the methods employed, and the timeline for notifying state and federal governmental agencies. The companies retain a third-party cybersecurity firm to assist with potentially significant cybersecurity incidents and have invested in cybersecurity insurance to offset costs incurred from any such cybersecurity incidents. To manage cybersecurity risks associated with the companies' use of third-party service providers, the companies incorporate security requirements into contracts, when deemed applicable, and pursue third-party security certifications for vendors with a higher risk profile.

companyName: CONSUMERS ENERGY CO

ticker: CMS-PB


text: Cybersecurity incident response plan and testing – We perform 24x7 security monitoring and execute a cybersecurity incident response plan with a dedicated team to respond to cybersecurity incidents. When a potential material cybersecurity incident is identified, we deploy cross-functional teams responsible for leading the initial assessment of priority and severity, and external experts may also be engaged as appropriate. Our cybersecurity teams prioritize responses to incidents depending on severity levels. We continuously improve our cybersecurity incident management plan through periodic tabletop exercises or simulations at the enterprise and business levels.

companyName: DONALDSON Co INC

ticker: DCI


text: The Company has dedicated incident management and response teams in place to facilitate response protocols and execute designed strategies necessary to mitigate business risk and support recovery initiatives. The Incident Management Team structure is based on the Incident Command System and follows a flexible, adaptable approach with response team membership designed to support expanding response team needs. An Incident Response Task Force (IRTF) is in place to oversee the assessment of cybersecurity incidents and operational response needs. The CISO and the Head of Regulatory Affairs/Relations co-lead IRTF response.

companyName: WSFS FINANCIAL CORP

ticker: WSFS


text: Board of Directors, which currently is composed of Barry Kostiner as the sole director, and who is also our sole executive director, has general oversight of the Company's risk of cybersecurity threats. Mr. Kostiner does not have any particular expertise in assessing or managing cybersecurity threats. The Company has not adopted any processes by which Mr. Kostiner is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Legacy Education Alliance, Inc.

ticker: LEAI


text: We maintain a comprehensive technology and cybersecurity program designed to ensure our systems are effective and prepared for information security risks. This includes regular oversight of our programs for security monitoring for internal and external threats to maintain the confidentiality and integrity of our information assets. We have a formal, risk-based and enterprise-wide risk assessment program, which incorporates the assessment of security risk exposures, including cybersecurity risks.

companyName: INTEGRAL AD SCIENCE HOLDING CORP.


text: We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our information security and risk management programs. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing of the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: Our Program is overseen by the Company's Board of Directors, which has delegated certain responsibilities to the Audit Committee and the Risk Committee. The Chairs of the Audit Committee and Risk Committee, in turn, report to the Board of Directors a summary of the presentations they have received relative to the Program. The Board of Directors oversees management's processes for identifying and mitigating risks, including cyber risks, to assist in the alignment of our risk exposure with our overall strategic business objectives. The Board of Directors has also engaged an experienced information security advisor to assist them with cybersecurity and data privacy oversight responsibilities. This advisor provides the Board of Directors with independent updates on external market cybersecurity threats and emerging risks on a regular basis.

companyName: BROOKLINE BANCORP INC


text: Our Cybersecurity Program is periodically evaluated by internal and external experts through penetration and vulnerability testing and other exercises which help us identify and assess material risks, evaluate the effectiveness of our Security Program in mitigating and managing these risks, and improve our security measures and planning, including by comparison to other companies and to industry standards. The results of these assessments are reviewed by our CISO and other members of management and are shared with the Risk Committee of our Board of Directors (the "Risk Committee").

companyName: Virtu Financial, Inc.

ticker: VIRT


text: Overseeing Third-Party Cybersecurity Risk Seaboard's information security program includes a documented process to oversee, identify and mitigate cybersecurity risk associated with Seaboard's use of new third-party service providers. As part of this process, prior to onboarding a third-party service provider, designated information security personnel from each segment will work with the internal business sponsors to perform a cybersecurity risk assessment and determine the potential impact on Seaboard's systems, data and networks if an identified cybersecurity breach were to occur. Risk assessments are documented, and reports are shared with the Information Security Team and others responsible for accepting the risk tolerance and monitoring the risks going forward.

companyName: SEABOARD CORP /DE/

ticker: SEB


text: Our full Board of Directors provides ultimate oversight for the cybersecurity program, in addition to other significant risks of Intuit. The Board of Directors has delegated to the Audit and Risk Committee to provide the primary oversight of cybersecurity risks. On a quarterly basis, the CISO and CyberCRAFT specialists present the Audit and Risk Committee with updates, metrics, and trends, such as the status of prior security events, existing and emerging threat landscapes, the results of audits or assessments, fraud prevention efforts, vulnerability detection and disclosure changes, and the status of projects to strengthen our security systems and improve incident readiness, and how these may affect broader enterprise risk management. Under our incident response processes' risk-based escalation protocols, the CISO, or other management, escalates certain incidents to the chair of the Audit and Risk Committee, who may then involve the broader committee or the full Board of Directors, as appropriate.

companyName: INTUIT INC.

ticker: INTU


text: Our cybersecurity risk management program includes multiple components, including information security maturity assessments, penetration testing, and vulnerability assessments, that are conducted periodically by both internal and external resources. We also conduct employee training and leverage third-party security tools, including but not limited to access controls, threat monitoring, and endpoint protection and response. We maintain a security operations center operated by a third party that collects cybersecurity threat data from multiple internal and external sources and determines if activity is potentially suspicious or malicious. We are in the process of developing and implementing additional cybersecurity policies and procedures.

companyName: Century Therapeutics, Inc.

ticker: IPSC


text: Risks from cybersecurity threats, in the future may, among other things, cause material disruptions to our or our subsidiaries' operations, which may materially affect our results of operations and/or financial condition. For more information about these risks, see the risk factor titled "Failures or interruptions in or breaches to our or our subsidiaries' computer systems or information technology or communication infrastructure or those of our third party vendors could materially and adversely affect our or our subsidiaries' operations" under Item 1A.

companyName: LOEWS CORP

ticker: L


text: The Company maintains a risk-based cybersecurity program designed to protect the confidentiality, integrity, and availability of our networks and systems that we own or are in our care. Our program is aligned to U.S. National Institute for Standards and Technology (“NIST”) standards and other applicable industry frameworks. We document our compliance efforts with regulations and standards that govern our business, including the Sarbanes-Oxley Act, the Family Educational Rights and Privacy Act (“FERPA”), the Gramm-Leach-Bliley Act Safeguards Rule, and the Payment Card Industry Data Security Standard (“PCI-DSS”).

companyName: Phoenix Education Partners, Inc.

ticker: PXED


text: Kemper's information security program is an element of the Company's broader Enterprise Risk Management (ERM) framework. This framework employs a management committee structure to review technology, compliance, and operational risks. The Company's Enterprise Risk Committee ("ERC"), composed of the Chief Executive Officer, the Chief Risk Officer, all executive vice presidents and the head of internal audit, meets at least quarterly to oversee the Company's ERM framework. This committee monitors the implementation of the ERM framework and makes modifications to the program from time to time as it believes appropriate. The ERC has several subcommittees that oversee particular risks, including cyber and information security.

companyName: KEMPER Corp

ticker: KMPR


text: Governance Framework Under the oversight of the Audit Committee of our Board of Directors, our cybersecurity function is managed by our Technology and Innovation team, led by our Senior Vice President, Chief Information Security Officer, Sara Schmidt, with support from the Internal Audit and Legal functions. Ms. Schmidt has served in the role since 2022. Before joining US Foods, Ms. Schmidt served as Chief Information Security Officer for Farmers Insurance, a national insurance company, from 2019 to 2022, and various other positions from 2015 to 2019. Ms. Schmidt began her career as a cryptography analyst with the National Security Agency, learning best practices and tactics to be an effective hacker and defender. After eight years with the NSA, she transitioned into the private sector, joining Perrigo Company from 2011 to 2015, before joining Farmers Insurance.

companyName: US Foods Holding Corp.

ticker: USFD


text: Upon a notification of concerning factors which may be indicative that a notable cybersecurity incident has occurred, the Cyber Security Subcommittee (Cyber Security Subcommittee) consisting of General Counsel, Head of HR & Chief Technical Officer (CTO) meets to make an initial assessment.

companyName: Beyond Air, Inc.

ticker: XAIR


text: For a discussion of potential cybersecurity risks affecting us, please refer to the "Risk Factors" section of this Annual Report.

companyName: Wenyuan Group Corp.

ticker: WYGC


text: The Audit Committee receives updates from the ERMWG and from members of management, including our CSO and CISO, on our cybersecurity risks at its quarterly meetings, and reviews metrics about cyber threat response preparedness, program maturity milestones, risk mitigation status, and the current and emerging threat landscape. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity threats or incidents, as well as any incidents with lesser impact potential.

companyName: Coinbase Global, Inc.

ticker: COIN


text: We rely on software, hardware, and network systems, including cloud-based technology, which are either developed by us or licensed from or maintained by third parties to maintain operations.

companyName: FARMER BROTHERS CO

ticker: FARM


text: The cybersecurity sub-committee regularly informs the risk management committee of matters related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the audit committee and board of trustees, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: National Storage Affiliates Trust

ticker: NSA


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches and other disruptions could compromise our information systems and expose us to liability, which could cause our business and reputation to suffer" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: Commercial Vehicle Group, Inc.

ticker: CVGI


text: As noted above, management of Ashland's cybersecurity risks is part of the Company's overall ERM program, which is overseen by the Board. The Board's Audit Committee has primary responsibility for the oversight of the Company's information and cybersecurity risks and the programs established to manage such risks. The Audit Committee fulfills this oversight responsibility through receiving regular (and as needed) reports and updates from the Company's Cyber Security Director and Ashland's Board also receives periodic reports updates from the Cyber Security Director and the Audit Committee regarding information and cybersecurity matters.

companyName: ASHLAND INC.

ticker: ASH


text: In addition, in accordance with Gramm-Leach-Bliley Act requirements regarding safeguarding and protecting customer information, an Information Security Risk Assessment is conducted at least annually by the Risk Department and reviewed with the Management Risk Committee, the ERM Committee, and the Board of Directors. A risk analysis is performed to evaluate current processes, identify information assets, and determine the adequacy of the safeguarding and protection of confidential customer information collected and maintained. For each information asset identified, the criticality of the asset, the threats to the defined asset, the likelihood of compromise of the asset, the business impact if an asset is compromised, and an overall risk rating for each asset are defined. The results of this assessment are reviewed with the IS Steering Committee and the Risk Committee and reported at least annually to the Board ERM Committee.

companyName: FARMERS & MERCHANTS BANCORP INC

ticker: FMAO


text: Since our commencement of operations, we have not experienced a material information security breach incident and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors— Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of its confidential information and/or damage to its business relationships."

companyName: Crescent Private Credit Income Corp


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, however, like other companies in our industry, we and our third-party information technology service providers and vendors have from time to time experienced threats that could affect our information or systems. For more information, please refer to Item 1A, "Risk Factors," in this Annual Report.

companyName: MBX Biosciences, Inc.

ticker: MBX


text: We believe that our current preventative actions and response activities provide adequate measures of protection against security breaches and generally reduce our cybersecurity risks. However, cybersecurity threats are constantly evolving, are becoming more frequent and more sophisticated and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them. While we have implemented measures to safeguard our operational and technology systems and have established a culture of continuous learning, monitoring and improvement, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. However, as of the date of this Annual Report, management has determined that none of the cybersecurity attacks that we have experienced has resulted in a material impact on our financial condition, results of operations or business strategy. In addition, as of the date of this Annual Report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition.

companyName: Mistras Group, Inc.

ticker: MG


text: The Director of Information Technology meets with the Chief People Officer periodically to monitor and review the outcomes of our cybersecurity risk management processes and to discuss and address matters related to cybersecurity risk management strategy. The Director of Information Technology, working with the Chief Legal Officer and Chief People Officer, provides periodic reports to the audit committee, which is responsible for reviewing and overseeing the Company's risk management processes, including cybersecurity risks. The Chief Financial Officer, Chief People Officer and Chief Legal Officer and/or other senior members of the legal team, participate in audit committee meetings, which are generally led by the Chief Financial Officer, as well as meetings of the full board of directors.

companyName: C4 Therapeutics, Inc.

ticker: CCCC


text: The Company designs and assesses the cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The Company uses the NIST CSF as a guide to help identify, assess, and manage cybersecurity risks relevant to its business; this does not imply that the Company's cybersecurity program meets any particular technical standards, specifications, or requirements.

companyName: Seneca Foods Corp

ticker: SENEA


text: As of the date of this filing, we have not identified any cybersecurity threats that are reasonably anticipated to have a material effect on our business strategy, results of operations or financial condition. Maintaining a robust information security system is an ongoing priority for us and we plan to continue to identify and evaluate new, emerging risks to data protection and cybersecurity both internally and through our engagement of third-party service providers.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: Our cybersecurity program is managed by the Company's Security and Corporate Engineering organization, which is led by our CSO, who reports directly to the CEO. Currently, our CSO is Erika Dean. Ms. Dean, who joined the Company in 2021, has over twenty years of experience in the security industry. Prior to joining our Company, she held a variety of leadership positions in cybersecurity at Capital One, including as Vice President, Divisional Chief Information Security Officer. Additionally, several of Robinhood's subsidiaries, including RHC, RHF, and RHS, have a Chief Information Security Officer, who reports to the CSO, and a Risk Operating Committee ("ROC") that manages risks, including cybersecurity risks, specific to each entity. The Chief Information Security Officers have expertise in cybersecurity, industry and regulatory standards, risk management, and security operations. The Security organization elevates risks to the ROCs where applicable. Our cybersecurity program is aligned with industry standards and best practices, such as the NIST CSF, and we engage third-party consultants annually to conduct a NIST CSF maturity assessment of our cybersecurity program.

companyName: Robinhood Markets, Inc.

ticker: HOOD


text: Failure of our information security program to prevent or detect a cyber incident could result in the compromise of Company and customer information, reputational damage, and/or financial loss. During the periods covered by this report, we did not experience any material cyber incidents and the expenses we incurred from cyber incidents were immaterial. While prior incidents have not had a material impact on us, future incidents could have a material adverse effect on our business, results of operations and cash flows. For additional information about our cybersecurity risks, see Item 1A — Risk Factors on this Annual Report on Form 10-K.

companyName: Apyx Medical Corp

ticker: APYX


text: Our information security management team is led by a global CIO to whom the CISO reports. The CIO, who reports directly to the Chief Executive Officer ("CEO"), has more than 30 years of related experience and is responsible for IT, information security and business applications at a strategic level across our global platforms. Moreover, the CIO is also responsible for reporting any information security matters to our Disclosure Committee to support compliance with applicable disclosure obligations. Our CISO has held various positions in the information security field over the past 18 years, including senior level positions across multiple industries with a focus on establishing and executing systems and security strategies to protect corporate data and improve regulatory compliance. The experience of our information security management spans various job practice analysis areas and is underpinned by relevant education and certifications as well as decades of in-field experience in areas such as information security program development, information security governance, risk management and information security incident management.

companyName: PRA GROUP INC

ticker: PRAA


text: Activities to Prevent, Detect, and Minimize Cybersecurity Incidents We undertake various activities to prevent, detect, and minimize the effects of cybersecurity incidents. These activities include: ensuring that company data accessed via a desktop or laptop computer is only accessible from company-owned computers ensuring that company-owned computers are regularly updated and maintained, are running the latest versions of our Endpoint Detection and Response antivirus software ensuring that company-owned computers access the internet through secure connections via our corporate VPN solution updating and assessing our cybersecurity technologies such as our firewall and various cybersecurity software Impact of Previous Cybersecurity Incidents At this time, we have not identified any risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected us. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us.

companyName: Byrna Technologies Inc.

ticker: BYRN


text: Our management team, lead by our Executive Director, Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants. Our Executive Director, Information Technology's experience includes 25 years of experience in managing IT environments including assessing the overall risk management program and material risks, as well as building our cybersecurity framework over the past six years.

companyName: Aligos Therapeutics, Inc.

ticker: ALGS


text: The Audit Committee of our Board of Directors oversees risks associated with information technology and cybersecurity. Cybersecurity risks and incidents identified through these processes are evaluated by our CDIO and VP of Platforms, Infrastructure and Cybersecurity. Our VP of Platforms, Infrastructure and Cybersecurity provides regular updates on a quarterly basis, and more frequently as required, on these matters to the Audit Committee of our Board of Directors. Such reports may include discussions on current control audits, risk assessments, proposed mitigation measures, and other key information technology and cyber initiatives.

companyName: AVIS BUDGET GROUP, INC.

ticker: CAR


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our cybersecurity risk management program includes: • Experienced third-party consultants and/or service providers that assist us to develop, implement, and maintain information technology risk management measures. • Oversight of executive management with experience in areas relating to cybersecurity. • Threat protection software, including, anti-virus, anti-malware, email link protection, and email spam filters that are fine-tuned to mitigate threats to our organization. • Cloud-based service providers that require strong passwords, access controls, and multi-factor authentication. • Periodic cybersecurity and phishing awareness training of our employees, including computer-based training and internal communications. • Annual business continuity testing. • Periodic reporting to the board of directors on matters relating to cybersecurity.

companyName: Global Self Storage, Inc.

ticker: SELF


text: Management, provided by Ashford Inc., is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer of Ashford Inc. and the Chief Technology Officer for Remington Hospitality. A Cyber Incident Response Team comprised of Ashford Inc. and Remington Hospitality employees meets bi-weekly to review incidents that have occurred and/or impacted the Company's electronic assets. The Chief Technology Officer of Remington Hospitality reviews weekly reports that contain an overview of the activity in the department, any United States Computer Emergency Readiness Team alerts processed and all findings from the preventative maintenance tools. The Chief Technology Officer provides such report to the Chief Financial Officer on a quarterly basis. The Audit Committee of the board of directors is then briefed each quarter on the occurrence of any cybersecurity incidents. The board of directors will also be provided an overview of the information security program on an annual basis, including updates on Remington Hospitality's IT team, IT training, implementation, IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.

companyName: ASHFORD HOSPITALITY TRUST INC

ticker: AHT


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the audit and risk committee oversight of cybersecurity and other information technology risks. The audit and risk committee oversees management's implementation of our cybersecurity risk management program.

companyName: Mereo BioPharma Group plc

ticker: MREO


text: In April 2022, we experienced a cybersecurity incident that temporarily disrupted a subset of our hospital operations and involved the exfiltration of certain confidential company and patient information. We incurred significant costs to remediate the issues, sustained lost revenues from the associated business interruption and incurred other related expenses. Following this incident, we implemented certain changes to our information systems and processes meant to provide additional protections to our environment, including enhancements to our Security Operations Center, system backups, training practices, detection tools and capabilities, and implementation of new tools and processes, among others. However, we continue to face a heightened risk of cybersecurity threats targeting healthcare providers, including ransomware attacks, which may materially impact our operations. Threat actors continue to proliferate, adapt and devote significant effort to attacking the information systems and electronically transmitted and stored data of healthcare providers and related entities.

companyName: TENET HEALTHCARE CORP

ticker: THC


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President, Corporate Controller and supported by consultants with experience in managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs as needed. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to our board of directors about material cybersecurity threat risks.

companyName: NexImmune, Inc.

ticker: NEXI


text: If we were to experience a cybersecurity incident, we may suffer interruptions in service, loss of assets or data, or reduced functionality. Security breaches of our systems which allow inappropriate access to or inadvertent transfer of information and misappropriation or unauthorized disclosure of confidential information, belonging to us or to our employees, providers, suppliers, customers or insurance companies could result in our suffering significant financial and reputational damage. Though we take steps to ensure our products and software are secure, a cyber-attack could result in the loss or compromise of our or our employees', suppliers' and customers' critical data. If a supplier or customer alleges that a cyber-attack causes or contributes to a loss or compromise of critical data, whether or not caused by us, we could face harm to our reputation and financial condition and incur regulatory repercussions. See Item 1A "Risk Factors – Security and privacy breaches may expose us to liability and cause us to lose customers". A cybersecurity incident could materially harm our reputation and financial condition and cause us to incur legal liability and increased costs when responding to such events.

companyName: Turning Point Brands, Inc.

ticker: TPB


text: Our information security function, which includes our Vice President of Information Technology ("IT") and third-party service providers, legal department and security committee, helps identify, assess, and manage the Company's cybersecurity threats and risks. Our information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: using automated tools, conducting audits, evaluating threats, and performing vulnerability assessments.

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: The Company's Board of Directors has oversight responsibility for our strategic and operational risks. The Audit Committee of the Board of Directors is responsible for board-level oversight of cybersecurity risk; however, the full Board is typically present for Information Technology (IT) and Cybersecurity briefings. As part of its oversight role, the Audit Committee receives reporting about the Company's cybersecurity program, activities, threats and incidents (if any) through periodic updates. The cybersecurity program is managed by our outsourced IT infrastructure team with oversight and coordination by our CFO, who reports directly to our CEO. Utilization of an outsourced IT infrastructure team allows Data I/O to access the necessary breadth and depth of leading cybersecurity programs, staff, expertise, and tools. The IT infrastructure team monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity function, including the operation of the Company's incident response plans, which include appropriate escalation to the CFO, CEO and the Audit Committee.

companyName: DATA I/O CORP

ticker: DAIO


text: As part of our overall risk management program, we provide training to employees at all levels on cybersecurity awareness and the protection of confidential information. In addition, we have established a cybersecurity incident response process that includes procedures for detecting and responding to cybersecurity incidents. The Company also participates in a cybersecurity risk insurance policy.

companyName: Credo Technology Group Holding Ltd

ticker: CRDO


text: Our Security Team is responsible for assessing and managing our material risks from cybersecurity threats and is primarily responsible for our overall Cybersecurity and Privacy Programs and collaborates with other employees and third parties to identify and mitigate applicable risks. Our Security Team is composed of certified cybersecurity professionals responsible for assessing and managing cybersecurity risks, led by the Senior Director of Information Security & Compliance. The qualifications of our Security Team include the following industry-recognized certifications: ISC2 Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (C|EH), Certified Incident Handler (GCIH), Certified Intrusion Analyst (GCIA), GSEC, CompTIA Security+, A+ Network+, CISM, CCSK, MCSA, MCSE, MCP, MCT, and Cisco Certified Network Associate (CCNA). The Senior Director of Information Security & Compliance reports to our Chief Technology Officer, who has over 19 years of experience in information technology. The Senior Director of Information Security & Compliance brings over 13 years of experience in risk management, cybersecurity and compliance. The Security Team's experience in information security and cybersecurity spans across various industries, including healthcare, technology, and critical infrastructure.

companyName: GoodRx Holdings, Inc.

ticker: GDRX


text: The Company also holds annual employee trainings on cybersecurity, conducts phishing tests and generally seeks to promote awareness of cybersecurity risk through communication and education of its employees.

companyName: MARTIN MARIETTA MATERIALS INC

ticker: MLM


text: We face a number of risks from cybersecurity threats, which may materially affect our business, financial condition, and results of operations, because our business is dependent on the successful operation of our payroll, transaction, financial, accounting, and other data processing systems. We cannot eliminate all risks from cybersecurity threats or provide assurances that we have detected all cybersecurity incidents. Please refer to Part I, Item 1A, "Risk Factors" for further discussion of our cybersecurity-related risks.

companyName: Dayforce, Inc.

ticker: DAY


text: The Audit Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: AUDACY, INC.


text: Our cybersecurity risk management program also assesses third party providers, such as vendors, suppliers, and other business partners. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third party providers and potential risks when handling or processing our employee, business, or customer data.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: The Company has not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, for the period covered by this annual report. For a discussion regarding risks associated with cybersecurity threats, see Risk Factors – Risks Relating to Our Business – "If our information technology, telecommunications or other computer systems become unavailable or unreliable, our ability to conduct our business could be negatively or severely impacted" and "Failure to maintain the security of information technology systems and confidential data may expose us to liability."

companyName: BERKLEY W R CORP

ticker: WRB


text: The Company's Information Technology Manager or a delegate thereof also prepares a report for the Audit Committee and the Company's board of directors concerning material risks, if any, from cybersecurity threats at least once per quarter, and more often to the extent necessary pursuant to the escalation criteria set forth in the Company's processes described herein.

companyName: Sow Good Inc.

ticker: SOWG


text: Board of Directors is responsible for the oversight of cybersecurity risk management. Our Board has delegated regular oversight of the cybersecurity risk management program to our Audit Committee, which includes oversight of information security and cybersecurity threats and related compliance and disclosure requirements. On a quarterly basis, our executive management team provides an update to our Audit Committee regarding our cybersecurity risk management program, including any critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards. The executive management team also notifies the Audit Committee of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.

companyName: Motus GI Holdings, Inc.

ticker: MOTS


text: 8x8's cybersecurity program is aligned with the National Institute of Standards and Technology, or NIST, cybersecurity framework, a widely recognized set of guidelines for managing and mitigating cybersecurity risks. By leveraging the National Institute of Standards and Technology framework, 8x8 has implemented a comprehensive and structured approach to identifying, protecting, detecting, responding to, and recovering from cybersecurity incidents.

companyName: 8X8 INC /DE/

ticker: EGHT


text: Dr. Boris Kogan, Chief Information Security Officer: Dr. Kogan has served as the Company's Chief Information Security Officer since 2016. Dr. Kogan has over 20 years of cybersecurity management experience in the financial services sector. Earlier in his career, after obtaining a Ph. D. in Computer Science from Princeton University, Dr. Kogan served on the faculty of George Mason University, where he conducted government-sponsored research in cybersecurity.

companyName: Interactive Brokers Group, Inc.

ticker: IBKR


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. Our Board of Directors is responsible for general cybersecurity risk oversight and stays informed on data privacy and information security issues and vulnerabilities that may be applicable to the Company. Our Board of Directors reviews and evaluates management's evaluation and mitigation of cybersecurity risks as part of its oversight of the Company's risk management program. Management periodically reviews cybersecurity risks and risk mitigation plans and activities with the Board of Directors. We outsource most aspects of our information technology management and these third-party providers are available to address any cybersecurity issues that may arise.

companyName: STREAMLINE HEALTH SOLUTIONS INC.


text: Matson's information security, internal audit, business continuity and risk management teams help to identify and assess cyber and information security threats and vulnerabilities, and establish the appropriate business systems, preventive controls and risk mitigation strategies. The main objectives of Matson's approach to cyber and information security are to protect confidential information while maintaining data integrity and availability; support legal and regulatory compliance; and prevent disruptions to business operations. The Company regularly enhances its systems, controls and strategies in an effort to guard against security breaches and unauthorized access to Matson systems or data and develops policies to guide the appropriate handling and protection of sensitive information by Matson. This includes managing third-party supply chain risks with its key vendors and business partners. It also maintains incident response and remediation plans which provide that cybersecurity incidents be communicated to the Company's senior leaders who are responsible for assessing the risks associated with a cybersecurity incident and initiating the Company's incident response plan. The Company's incident response and remediation plans are further supported by ongoing security monitoring services as well as a dedicated management team focused on business continuity to help support operations and mitigate disruptions should a breach, unauthorized access or other disruption event occur. In addition, the Company has established a zero trust network access roadmap that includes key security controls designed to help protect Matson employees and contractors with access to Matson systems against phishing and brute force password attacks.

companyName: Matson, Inc.

ticker: MATX


text: Oblong's Director of IT is responsible for assessing and managing cybersecurity risks. It has extensive experience focused on increasing the organization's resilience to security threats and staying current on new developments by monitoring the cybersecurity landscape. The team monitors Oblong's IT environment for potential security threats, investigating and acting on security events to minimize potential risks to the environment.

companyName: TaoWeave, Inc.

ticker: TWAV


text: Cybersecurity Risk Management and Strategy FedEx has an information technology ("IT") risk management process designed to identify and manage risk within its IT environment, including cybersecurity. The IT risk management process is based on an established framework for identification, measurement, and monitoring of cybersecurity and other risk areas and supplements our Enterprise Risk Management ("ERM") process and framework. Our IT risk management, ERM, and compliance teams collaborate to regularly evaluate and manage cybersecurity-related risks using various tools and services. Leveraging components from multiple industry frameworks and best practices such as the International Organization for Standardization 27001 and National Institute of Standards and Technology ("NIST") standards, including the NIST Cybersecurity Framework, our cybersecurity program prioritizes governance, identification, protection, detection, response, and remediation measures.

companyName: FEDEX CORP

ticker: FDX


text: In addition, our board and/or the STC receives regular presentations and reports throughout the year on cybersecurity and information security risk. These presentations and reports address a broad range of topics, including updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources and organization, the threat environment and vulnerability assessments, and specific and ongoing efforts to prevent, detect, and respond to internal and external incidents and critical threats. In addition, the CISO provides prompt and timely information on any cybersecurity or information security incident that may pose significant risk to us and continues to provide regular reports on any such incident until its conclusion.

companyName: Federal Home Loan Bank of Indianapolis


text: With over a decade of dedicated service to BNED, our current CISO brings a wealth of experience and expertise to the organization, including over three decades of Information Technology ("IT") experience. The last two decades have focused on IT security and innovative ways to manage and lead a security team. Previously, the CISO was the Director of IT Security and Infrastructure at The Children's Place Inc. The CISO is experienced in deploying a Zero Trust framework, Identity and Access Management programs, Email and Web Gateways, managing IT compliance for SOX, PCI, and ADA and has developed and introduced new information security and computer risk management programs based on National Institute of Standards and Technology (NIST) Cybersecurity Framework across numerous platforms for multiple retail chains.

companyName: Barnes & Noble Education, Inc.

ticker: BNED