text: We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to provide alerts and monitor and block suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal and third -party specialists. We also maintain a third -party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the ability to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: FIRST OF LONG ISLAND CORP


text: Our information security practices include development, implementation, and improvement of policies and procedures to safeguard information and ensure availability of critical data and systems. We have adopted a Cybersecurity Incident Response Plan that applies if a security event occurs. Our Incident Response Plan provides a common framework for responding to security incidents. This framework establishes procedures for identifying, validating, categorizing, documenting, and responding to security events that are identified by or reported to the Chief Information Officer (CIO). Our Incident Response Plan applies to W&T personnel including contractors and partners that perform functions or services that require securing W&T information assets, and to all devices and networks that are owned by W&T. The Incident Response Plan details the coordinated, multi-functional approach for investigating, containing, and mitigating incidents. Under our Incident Response Plan, cybersecurity incidents are escalated based on a defined incident categorization to the CIO and the General Counsel. Regular updates are provided by the Cybersecurity team to the CIO, who will maintain communication and information flow to senior leadership including the General Counsel, Chief Financial Officer, and other cybersecurity program stakeholders as well as the Audit Committee and/or the Board of Directors as appropriate. Generally, our incident response process follows the National Institute of Standards and Technology (NIST) framework and focuses on preparation; detection and analysis; containment, eradication, recovery and post-incident remediation.

companyName: W&T OFFSHORE INC

ticker: WTI

secItem: Item 1C


text: Our information security controls and practices are certified against globally recognized standards: ISO 27001, ISO 27701, ISO 27017, SOC 2 Type II. We are also aligned to cybersecurity practices and controls recommended by the National Institute of Standards and Technology (NIST), part of the U.S. Department of Commerce.

companyName: JFrog Ltd

ticker: FROG


text: Our information technology team is led by our Chief Information Officer who has extensive experience working with information security systems. Our information technology team consists of individuals with expertise in assessing, preventing and addressing cybersecurity risk and is responsible for executing our cybersecurity program as well as communicating regularly with senior management, our cybersecurity governance committee, the Audit Committee and the Board. Our cybersecurity governance committee, comprised of our Chief Financial Officer, Chief Legal Officer, Chief Information Officer, Head of Internal Audit and senior members of our information technology team are responsible for developing and maintaining our cybersecurity policies and standards, monitoring ongoing compliance and program updates, and ensuring our information security is aligned with our business objectives and strategies.

companyName: W. P. Carey Inc.

ticker: WPC


text: The governance of cybersecurity risks is a critical function of our Board of Directors, with the Audit Committee playing a key role in the oversight of cybersecurity and related technology risks. The Audit Committee is tasked with monitoring the effectiveness of our cybersecurity risk management program as implemented by management.

companyName: GridAI Technologies Corp.

ticker: GRDX


text: We also have implemented and continue to maintain policies, procedures, systems, controls and technology to oversee and identify the cybersecurity risks associated with our use of third-party service providers. For example, we conduct thorough cybersecurity risk assessments of all third-party service providers prior to engagement and ongoing monitoring to ensure compliance with our robust cybersecurity requirements. The monitoring includes periodic audits of third-party systems and vendors. We engage third-party consultants and auditors in connection with assessing, identifying and managing material risks from cybersecurity threats. Our collaboration with these third parties includes independent audits, threat assessments, and consultation on security enhancements.

companyName: Paycom Software, Inc.

ticker: PAYC


text: These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity. The Board and/or our Audit Committee oversee our cybersecurity risk exposures and the steps taken by management to identify, monitor and mitigate cybersecurity risks to align our risk exposure with our strategic objectives. With respect to such cybersecurity risk oversight, our Board and/or our Audit Committee receive periodic reports and/or updates from management on the primary cybersecurity risks facing us and the measures we are taking to mitigate such risks. In addition to such reports and updates, our Board and/or our Audit Committee receive updates from management as to changes to our cybersecurity risk profile or certain newly identified risks. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel, senior leadership and the Board or Audit Committee, as appropriate.

companyName: Arogo Capital Acquisition Corp.


text: The Company has implemented a cybersecurity program that oversees, assesses, and manages its cybersecurity risks. As a component of the Company's formal enterprise risk management program, whose goal is to support the business objectives and strategy, the cybersecurity program leverages multiple security measures to protect the integrity of the Company's information assets. The program's strategy aligns to the National Institute of Standards and Technology Cybersecurity Control Framework, where controls are implemented throughout our environment to achieve five categorical objectives of a cybersecurity program, including identification, protection, detection, response, and recovery.

companyName: SAFETY INSURANCE GROUP INC

ticker: SAFT


text: We are committed to maintaining the confidentiality, integrity, and availability of our information systems and data. As part of this commitment, we have implemented a comprehensive cybersecurity program to protect against unauthorized access, use, disclosure, modification, or destruction of our information assets. We are committed to ensuring the security and protection of our Company's information assets and the personal information of our employees, and other stakeholders.

companyName: OLD MARKET CAPITAL Corp

ticker: OMCC


text: We maintain a cybersecurity risk assessment program and framework as set forth in our cybersecurity policies and standards. The foundation of our cybersecurity program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, which includes a set of controls to prevent, detect, and respond to cybersecurity threats and incidents. These controls include constant monitoring, log collection and analysis, threat hunting and intelligence surveillance, and regular vulnerability scans/penetration tests. Additionally, in furtherance of assessing, identifying and managing material cybersecurity risks, we: • Leverage technology solutions, including proactive detection tools, to protect our assets and detect threats in our environment; • Perform regular internal assessments of our cybersecurity program against the NIST Cybersecurity Framework. The results of these assessments are then reviewed and, based on such findings, action plans are developed and progress tracked through completion; • Analyze both internal and external cybersecurity incidents and related threat intelligence to determine applicability to our environment and industry. Findings from such analyses are then reviewed and utilized to create action plans where applicable and relevant to our environment and industry; • Maintain an enterprise-wide disaster recovery governance program, which includes cybersecurity-related disaster recovery standards and compliance procedures related thereto; • Regularly perform cybersecurity-related disaster recovery testing to ensure that the Company's mission-critical systems are recoverable, in support of the business continuity needs of our various business lines; and • Integrate each of our business and corporate groups with our internal cybersecurity team to ensure cybersecurity requirements are embedded into operating environments as appropriate, which drives business strategies, budgeting, and similar processes. In addition, senior and executive management, as well as our Board of Directors, regularly review our financial planning processes for these areas, inclusive of our cybersecurity programs.

companyName: Trane Technologies plc

ticker: TT


text: UnitedHealth Group manages cybersecurity and data protection through a continuously evolving framework. The framework allows us to identify, assess and mitigate the risks we face, and assists us in establishing policies and safeguards to protect our systems and the information of those we serve.

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: The Bank has implemented an information security program aimed at protecting our customers, the Bank, and our shareholders. The program addresses risks identified by the Bank, including cybersecurity risks. Protecting confidential customer information and maintaining the availability of banking services are the primary objectives of the information security program.

companyName: VWF Bancorp, Inc.

ticker: VWFB


text: Reliance on the security systems of our service providers: We utilize the services of various providers for items such as intellectual property management, payroll, and accounting, and rely on their systems to prevent or detect cybersecurity threats and incidents. Develop a Cybersecurity Framework: Establish a formal risk assessment process to identify vulnerabilities. Engage Cybersecurity Expertise: Consider hiring or consulting with cybersecurity professionals to guide our strategy.

companyName: SolarWindow Technologies, Inc.

ticker: WNDW


text: The members of management who lead our Cybersecurity Program have extensive experience in technology, cybersecurity, and information security. Our CIO has over 35 years of relevant experience, including 25 years leading technology teams at multiple global financial services institutions, and is a Certified Information Security Manager and Registered Series 99 Operations Professional. Our CISO has over 25 years of financial services industry experience, with varying positions in information technology, security, and risk management, and is a Certified Information Systems Security Professional and Registered Series 99 Operations Professional. Both our CIO and CISO also participate in various financial services industry committees and cybersecurity advisory boards.

companyName: RAYMOND JAMES FINANCIAL INC

ticker: RJF


text: Third-Party Service Provider Risk Management We have a process in place to oversee and identify risks from cybersecurity threats associated with our use of key third-party service providers during the course of engagement. The company maintains a formal risk management program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks. Our vendor security assessment process evaluates key vendors and, where appropriate, assesses vendor's controls for IT security, privacy, business continuity, and other third-party risks. Following an evaluation, the company determines and prioritizes risks based on their potential impact, which help inform the appropriate level of additional due diligence and ongoing compliance monitoring.

companyName: Twist Bioscience Corp

ticker: TWST


text: The Adviser is responsible for overseeing the Company's risk management function and generally relies on the CIO, CISO, and Head of NFR CTIS to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of NFR CTIS has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies.

companyName: North Haven Net REIT


text: The Cybersecurity Committee is responsible for, among other things: • Reviewing management's implementation of cybersecurity programs, privacy programs and related risk policies and procedures and management's actions to (a) safeguard the effectiveness of such programs and policies and the integrity of the Company's electronic systems and facilities and (b) prevent, detect and respond to cyber-attacks or information or data breaches involving the Company's electronic information, intellectual property and data; • Reviewing information from the Company's IT Department regarding matters related to the management of cybersecurity risks and privacy risks; • Reviewing management's cybersecurity and privacy crisis preparedness and incident response plans (including policies and procedures regarding public disclosure of any such incidents) and the Company's disaster recovery capabilities; • In the event of an identified breach or attempted breach, the details and impact of any such breach or attempted breach of the Company's information technology systems, networks and/or the types of information, data, and assets collected, created, used, processed, and/or maintained by or on behalf of the Company, including personal information and/or any information or assets of the Company's customers, consumers, employees and business partners, the appropriately investigating any such events, the response to such events, and the implementation of measures to help prevent the recurrence of such events and review summaries of any incidents or activities that are required to be reported to the Audit Committee pursuant to any escalation policies applicable to such cybersecurity incident; • Reviewing the effectiveness of the Company's cybersecurity and privacy risk management programs and its practices for identifying, managing and mitigating cybersecurity and privacy risks across all business functions and recommending improvements, where appropriate; • Reviewing the Company's framework for adopting policies and procedures establishing cybersecurity and privacy risk-management governance, cybersecurity and privacy risk-management procedures, and cybersecurity and privacy risk control infrastructure; • Reviewing the Company's processes and systems for implementing and monitoring compliance with cybersecurity and privacy risk-management and cybersecurity and privacy risk-control policies and procedures, including:

companyName: Cano Health, Inc.


text: Under the oversight of the Audit Committee, and as directed by our Chief Financial Officer, our VP of Technology, has established policies for and is primarily responsible for overseeing our cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats. Our VP of Technology has over 20 years of experience in the technology industry, with much of that experience in smaller companies and in software architecture and implementation. Our Chief Financial Officer and our VP of Technology are informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan. In addition, our Chief Financial Officer and our VP of Technology also coordinate with our legal counsel to assess and manage material risks from cybersecurity threats. Our Chief Financial Officer and our VP of Technology provide updates annually or more frequently as appropriate to the Audit Committee.

companyName: Mobile Infrastructure Corp

ticker: BEEP


text: Diamondback's cybersecurity risk management program is integrated into its overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas that apply to us.

companyName: VNOM Sub, Inc.


text: We take a comprehensive approach to cybersecurity risk management. While securing our customers and stakeholders' data is a top priority, like many companies with a public presence, we are subject to human-targeted and AI-assisted cyberattacks. Our board of directors (the "Board") and our management are involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices designed to assess, identify, and manage material risks from cybersecurity threats. We have devoted significant financial and personnel resources to implement and maintain security measures in an effort to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments in our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be effective, as cyber criminals are becoming more sophisticated and effective every day and increasingly targeting enterprise software companies. Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that such incidents will not materially affect us, including our business strategy, results of operations, or financial condition. For the year ended December 31, 2024, we are not aware of any material cybersecurity incidents that had a significant impact on our operations or financial condition. For more information on our cybersecurity related risks see the risk factor entitled "We rely on information technology ("IT") and other systems and platforms, and any failures, errors, defects or disruptions in our or our vendors' or other partners' systems or platforms could diminish our brand and reputation, subject us to liability, disrupt our business, affect our ability to scale our technical infrastructure and adversely affect our business, financial condition, operating results and growth prospects" in Part I, Item 1A Risk Factors of this Annual Report on Form 10-K, above.

companyName: Skillz Inc.

ticker: SKLZ


text: The Company's employees identify and assess risks from cybersecurity threats by monitoring and evaluating the cybersecurity threat environment and the Company's risk profile. The Company is not currently aware of any risks from cybersecurity threats nor has the Company had a previously cybersecurity incident that in either case have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations or financial condition.

companyName: CLEARONE INC

ticker: CLRO


text: Our cybersecurity program, which is overseen by the C-ROC, is managed by IT Management as part of its responsibility for enterprise-wide cybersecurity strategy, policies, implementing our monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes and various other technological and administrative safeguards. The team is led by our Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and our Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of our cybersecurity program.

companyName: BLUE OWL CAPITAL INC.

ticker: OWL


text: • Regular internal and external security audits and penetration tests by third-party security vendors; • Testing of new products and services to identify potential security vulnerabilities before release; • Regular network and endpoint monitoring; • Periodic red- and purple-team assessments from third-party service providers; • Business resiliency planning with disaster recovery and business continuity testing; • Role-based access controls to identify, authenticate and authorize individuals to access systems based on their job responsibilities; • Protection, including encryption, for the secure communication of sensitive data; • Monitoring of emerging data protection laws and implementation of changes to our processes designed to comply therewith; • Regular review of policies and standards related to cybersecurity; • At least annual security awareness training and testing of our employees; • Regular review of critical third-party security practices; • Tabletop exercises to simulate a response to a cybersecurity incident and to use the findings to improve our processes and technologies; • A cross-functional approach to addressing cybersecurity risk, with participation from Technology, Risk, Legal, Compliance, Privacy and Internal Audit functions; and • Cybersecurity risk insurance to provide protection against potential losses arising from a cybersecurity incident.

companyName: MSCI Inc.

ticker: MSCI


text: Our executive management team is primarily responsible for assessing and managing our material risks from cybersecurity threats. Management supervises both our internal cybersecurity and IT related personnel, as well as our retained external cybersecurity consultants and vendors. Additionally, they supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefing from internal or external security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants or vendors engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: LEAFBUYER TECHNOLOGIES, INC.

ticker: LBUY


text: Managing Material Risks & Integrated Overall Risk Management Our cybersecurity team, led by our Chief Information Security Officer, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example, through manual and automated tools, internal and external audits, third-party threat assessments and third-party conducted red/blue team testing and tabletop incident response exercises and by subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments for internal and external threats and conducting vulnerability assessments.

companyName: CYTOKINETICS INC

ticker: CYTK


text: We have not encountered cybersecurity incidents or identified risks from cybersecurity threats that have had a material adverse effect on our operations or financial standing.

companyName: APOGEE ENTERPRISES, INC.

ticker: APOG


text: While we have not experienced a cybersecurity incident to date that has had a material impact on Oncor, we have experienced, and expect to continue to experience, threats and attempted intrusions into our technology systems and platforms. Our third-party vendors have been subject, and will likely continue to be subject, to acts that disrupt or attempt to disrupt the services they provide to us. Our technology team works to evaluate third-party solutions purchased, implemented or upgraded to ensure they meet our cybersecurity requirements. Threat actors could also attempt to use our third-party vendors as a conduit to attack us. We are subject to evolving cyber risks related to adversaries attacking our technology infrastructure and platforms and the technology infrastructure and platforms of third-party vendors. See "Item 1A. Risk Factors—Risk Related to Our Business and Operations—Cyber-attacks on us or our third-party vendors could disrupt business operations, initiate the loss or disclosure of critical operating or confidential data, have an adverse impact on our reputation, and expose us to significant liabilities." A future cybersecurity incident could potentially have a material impact on our business, operations and financial condition. In addition, non-compliance with electric industry specific regulations or violation of laws could have financial penalties, as well as impact our reputation, which could materially impact our results of operations or financial condition. Cybersecurity risk has also contributed to, and is expected to continue to contribute to, increased capital expenditures and operation and maintenance expenses, including as a result of the need for additional hardware, software, equipment, personnel, training and third-party service providers, as well as increased cyber insurance costs.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: We have a set of Company-wide cybersecurity policies and procedures and continue building these important document libraries. Management approves initial policies and reviews them periodically for updates and changes. Our network security provider follows the internationally recognized risk framework, ISO 27001. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a multi-faceted cybersecurity strategy based on prevention, detection, and mitigation. The Company continues to work to ensure the inclusion of our cybersecurity risks are fully incorporated into the Company's overall risk management approach.

companyName: Planet 13 Holdings Inc.

ticker: PLNH


text: The Board regularly receives reports from our executive officers and third parties on cybersecurity matters. In addition, the Board receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates.

companyName: ENCORE WIRE CORP


text: The Board receives annual reports from management on our cybersecurity risks and strategic updates. These reports are designed to provide the Board a view into the progress of previous efforts, an update on existing and new material risks, and an overview of proposed or planned cybersecurity-related projects, and foster a discussion of cyber threats trending within the industry and their applicability to the organization. If a new material risk is identified, or if the Company is impacted by a material security incident, the Audit Committee and the full Board of Directors are notified and apprised of developments.

companyName: ITT INC.

ticker: ITT


text: State regulators have also been increasingly active in implementing cybersecurity standards and regulations. Recently, several states have adopted laws and/or regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many such states have also recently implemented or modified their data breach notification and data privacy requirements. We expect this trend of state-level activity in those areas to continue, and we continue to monitor relevant legislative and regulatory developments.

companyName: BayCom Corp

ticker: BCML


text: We perform diligence, which includes reviewing SOC II reports, on certain third-party service providers who provide critical data and cloud services in order to oversee and identify risks from cybersecurity threats associated with such critical third-party service providers.

companyName: BOLLINGER INNOVATIONS, INC.

ticker: BINI


text: The Company recognizes the security of our banking operations is essential to protecting our customers, maintaining our reputation, and preserving the value of the Company. The Board of Directors, through the Board Risk Oversight Committee, provides direction and oversight of the enterprise-wide risk management framework of the Company, and cybersecurity represents a component of the Company's overall approach to enterprise-wide risk management. The Enterprise Risk Management Program establishes policies and procedures for assessing the effectiveness and efficiency of information security controls related to both design and operations. The Company leverages the following guidelines and frameworks to develop and maintain its Information Security Program including its cybersecurity risk management program: Federal Financial Institutions Examination Counsel Cybersecurity Assessment Tools and GLB Act and regulations. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach focused on the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents that may occur.

companyName: SHORE BANCSHARES INC

ticker: SHBI


text: Employee Cybersecurity Training The Company provides ongoing cybersecurity training and compliance programs to facilitate education for employees who may have access to the Company's data and critical systems. Employee phishing tests are conducted on a monthly basis.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: The Bancorp recognizes the importance of maintaining a cybersecurity risk management system designed to reduce the risks that cybersecurity threats pose to financial institutions. As such, the Bancorp has adopted proactive and defensive safeguards intended to better protect the Bancorp's information assets and supporting infrastructures from technology-related attacks. The Bancorp's Board of Directors and management oversee its information security and cybersecurity risk management programs. As further discussed below, the Bancorp has established various programs, policies and procedures which are designed to proactively protect information assets. However, not all incidents can be prevented. As a result, the Bancorp has also established various policies and procedures governing how to respond to security incidents, with the objective of minimizing any potential impacts. As of December 31, 2024, the Bancorp is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect Fifth Third, including its business strategies, results of operations or financial condition.

companyName: FIFTH THIRD BANCORP

ticker: FITB


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan and/or incident response policy, incident detection and response, a vulnerability management policy, disaster recovery/business continuity plans, risk assessments, implementation of security standards/certifications, encryption of data, network security controls, access controls, physical security, vendor risk management program, employee training, penetration testing, cybersecurity insurance, dedicated cybersecurity staff/officer, and systems monitoring.

companyName: Rubrik, Inc.

ticker: RBRK


text: Our cybersecurity risk management and strategy processes are overseen by our CFO and CLO. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.

companyName: Commercial Vehicle Group, Inc.

ticker: CVGI


text: Our cybersecurity risk management program sets forth a framework provided by our information security team to identify and mitigate vulnerabilities and risks in our information systems. Elements of the program include, among the other things, penetration tests on our networks and engaging in annual employee cybersecurity training.

companyName: SemiLEDs Corp

ticker: LEDS


text: We take a holistic, multi-layered approach to management and oversight of cybersecurity risks. Our board of directors has ultimate oversight responsibility but has delegated to the board's Care, Compliance, & Cybersecurity Committee focused and pertinent oversight duties, which have been integrated into our overall enterprise risk management program, as described below. Our Chief Information Officer provides quarterly reports on our cybersecurity program to the Care, Compliance, & Cybersecurity Committee. These reports include details and metrics on, among other things, our routine vulnerability assessments, internal and external threat intelligence, company-wide phishing exercises and training, device encryption, device patching, routine resilience efforts including quarterly disaster recovery exercises, tabletop incident response and business continuity exercises. The chairperson of the Care, Compliance, & Cybersecurity Committee briefs the full board of directors on such quarterly reports.

companyName: Enhabit, Inc.

ticker: EHAB


text: A third-party Managed Security Service Provider ("MSSP") covering all critical cyber defense functions such as data protection, identity and access management, insider risk management, security operations and threat intelligence. A training program that educates employees and management about cybersecurity risks and how to protect themselves from cyberattacks.

companyName: FIRST NORTHERN COMMUNITY BANCORP

ticker: FNRN


text: We regularly engage external and internal assessors and auditors to evaluate and audit our cybersecurity policies, procedures, standards, and practices. Results from these assessments are shared with management for remediation and with the Cybersecurity and Technology Committee of our board of directors on a regular basis. We have obtained, or are working toward obtaining, industry certifications and attestations and have aligned our cybersecurity program with the NIST Cybersecurity Framework and related controls.

companyName: HEALTHEQUITY, INC.

ticker: HQY


text: Our Risk Management Methodology is applied year-round and covers all of the Company's IT departments and processes. The results are used to generate and update risk and control matrices.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: Role of the Board Our Board of Directors has delegated primary responsibility for the oversight of cybersecurity to the Audit Committee, which reviews and oversees our programs, policies, practices and safeguards relating to: information technology, data privacy and protection, cybersecurity and fraud, identification, assessment, monitoring, mitigation and the overall management of those risks, and our cyberattack incident response and recovery plan. The Audit Committee receives regular reports from our Chief Information Officer (CIO) and CISO on, among other things, our cyber risks and threats, the status of measures to strengthen our cybersecurity systems, assessments of our Cybersecurity program, and our views of the emerging threat landscape. During fiscal 2025, substantially all of our directors attended the Audit Committee meetings in which the Committee received updates relating to cybersecurity.

companyName: Aramark

ticker: ARMK


text: In the event of a cybersecurity incident impacting the Company, the Advisor has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational and risk functions of Bain Capital, which may include coordinating with the relevant employees of the Advisor and management of the Company. The incident response plan includes notification to the applicable members of cybersecurity leadership, including Bain Capital's CISO, and, as appropriate, escalation to other relevant individuals.

companyName: Bain Capital Specialty Finance, Inc.

ticker: BCSF


text: Technology. PTC seeks to automate these processes and remove the potential for human error to the extent feasible by implementing technology solutions. From fundamental IT security to development of our software products and keeping our customers' data safe in the cloud, PTC aims to maintain a secure infrastructure that is continuously monitored for possible threats.

companyName: PTC INC.

ticker: PTC


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, including our customers', vendors', partners' and employees' data, including personal information.

companyName: CADENCE DESIGN SYSTEMS INC

ticker: CDNS


text: Management is made aware of current and evolving cybersecurity risks through the Cyber SteerCo reporting. Furthermore, in the event of a material or potentially material cybersecurity event, senior members of management are promptly informed of such event and oversee triage, response, and disclosure efforts pursuant to the terms of a documented incident response plan.

companyName: Baldwin Insurance Group, Inc.

ticker: BWIN


text: We have implemented data security standards in our architecture and system design techniques. Reviews and testing of our systems and subsystems are performed at regular intervals and are designed to ensure our capability to respond to cybersecurity incidents or threats. Our cybersecurity framework is based on the National Institute of Standards and Technology Cybersecurity Framework. In accordance with this framework, risks are analyzed for impact and probability to determine severity level, with classifications of critical, high, medium, or low risk. These processes have been integrated into our overall risk management system and processes and are part of our operating procedures, internal controls and information systems. In addition, we engage in an ongoing improvement process to enhance our cybersecurity posture.

companyName: DHI GROUP, INC.

ticker: DHX


text: 3. Risk Treatment – will detail the remediation process for risks, vulnerabilities and threats identified to reduce the risk to an acceptable level.

companyName: AVITA Medical, Inc.

ticker: RCEL


text: Cybersecurity Risks, Threats, and Incidents While we have not experienced any material cybersecurity incidents, there can be no guarantee that we, or any third parties with which we interact, will not be the subject of future successful attacks, threats, or incidents. We rely significantly on information technology for the operation of our business, including our All Access Pass and Leader in Me portals. For more information on cybersecurity risks we face, refer to Part I, Item 1A Risk Factors under the section entitled Cybersecurity and Information Technology Risks, which should be read in conjunction with the information presented in this Item 1C.

companyName: FRANKLIN COVEY CO

ticker: FC


text: Cybersecurity risks are assessed as part of our enterprise risk assessment and risk management program and our cybersecurity risk management program is designed and assessed based on recognized frameworks, including the NIST CSF.

companyName: Liberty Broadband Corp

ticker: LBRDA


text: We have implemented an information security governance policy governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and employee information that we store or process and the maintenance of critical services and systems. Our cybersecurity program is managed by our Chief Technology Officer and Head of Technology Infrastructure (together, "IT Management"), who report to our Chief Operating Officer. IT Management and its team are responsible for implementing proactive and reactive measures, including our monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes, and various other technological and administrative safeguards. Our cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks. Our policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Our processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with our physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to our devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of our cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework.

companyName: BLUE OWL CAPITAL INC.

ticker: OWL


text: We conduct an enterprise risk assessment that includes an assessment of cybersecurity risk in context with other enterprise-level risks. Furthermore, our CISO and our General Counsel regularly discuss cybersecurity risk mitigation. We carry errors and omissions insurance that provides some protection against the potential losses arising from a cybersecurity incident. For additional information regarding potential cybersecurity risks, see relevant business and operational risks under Item 1A, "Risk Factors," of this Annual Report on Form 10-K.

companyName: TELOS CORP

ticker: TLS


text: As part of our overall risk management process, we have established a cybersecurity risk management program for assessing, identifying, and managing risks from cybersecurity threats. Our cybersecurity risk management program is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the Federal Information Processing Standards Publication ("FIPS").

companyName: Entrada Therapeutics, Inc.

ticker: TRDA


text: Adient employs advanced detection tools to continuously track cybersecurity threats and incidents. Upon identifying potential risks, Adient swiftly implements mitigation and remediation measures. Subsequently, pertinent threats are reported by Adient's information security leadership team.

companyName: Adient plc

ticker: ADNT


text: The Company has several methods in place to carry out its security risk management strategy. We currently implement security controls to prevent unauthorized access, including but not limited to geo policies, AV scanning, and VPN restrictions. We use a SEIM to monitor and identify potential threats in order to constantly adjust our security posture.

companyName: Crown Equity Holdings, Inc.

ticker: CRWE


text: Our operations are highly dependent upon information systems that support our business processes. In the ordinary course of our business, we collect and store certain confidential information such as personal information of our residents and associates and information about our business partners, contractors, vendors, and suppliers. Cyber intrusions could seriously compromise our networks and the information stored therein could be accessed, publicly disclosed, misused, lost, or stolen. As such, we have established information security processes and policies using principles from industry recognized cybersecurity frameworks focused on: (i) developing organizational understanding to manage cybersecurity risks; (ii) applying safeguards to protect our systems; (iii) detecting the occurrence of a cybersecurity incident; (iv) responding to a cybersecurity incident; and (v) recovering from a cybersecurity incident. Where appropriate, these processes and policies are integrated into our overall risk management systems and processes.

companyName: Invitation Homes Inc.

ticker: INVH


text: We have designed and deployed a comprehensive cybersecurity risk management program that is embedded in our broader risk management framework, all of which is overseen by our Board of Directors. Our program is designed to include ongoing assessment of our critical assets; detection and analysis of potential threats; timely management of identified security risks; and prompt remediation planning and implementation. To successfully operate and monitor our security readiness, we maintain a data security and privacy team with substantial real-world experience to detect and respond to cybersecurity threats. Our multi-layered security is bolstered by technologies and partners and includes annual employee and vendor security awareness trainings, enhanced access control, data loss protection and vulnerability management, among other technical and process security controls. Our proprietary data architecture, AVA, incorporates high security controls around member data. Our information security program considers how attackers are using emerging technologies (such as artificial intelligence) to help inform our defensive tactics. Our team also regularly reviews emerging product technology to improve our capabilities.

companyName: Alignment Healthcare, Inc.

ticker: ALHC


text: Conducting our businesses involves the collection, storage, use, disclosure, processing, transfer, and other handling of a wide variety of information, including personally identifiable information, for various purposes in our businesses. Like other comparable-sized companies that process a wide variety of information, our information technology systems, networks and infrastructure and technology have been, and may in the future be, vulnerable to cybersecurity attacks and other data security threats. These types of attacks are constantly evolving, may be difficult to detect quickly, and often are not recognized until after they have been launched against a target. For more information about these and other cybersecurity risks faced by us, see "Risk Factors – Risks Related to Our Business and Industry – We rely on IT systems to conduct our business, and disruption, failure or security breaches of these systems could adversely affect our business and results of operations" and "– Cybersecurity attacks on or breaches of our information technology environment could result in business interruptions, remediation costs and/or legal claims".

companyName: Shimmick Corp

ticker: SHIM


text: To manage against existing conduct and new cybersecurity threats, we maintain enterprise-wide cybersecurity, crisis management, and information security policies and regular training and tests that reinforce the acceptable use of Ameren's information assets, protection of customer and employee data, and the role each employee plays in protecting Ameren against cybersecurity threats. Incident response plans and procedures are tested through recurring companywide cybersecurity exercises to promote readiness across the organization. The procedures are also designed to escalate incidents to appropriate members of management to guide the detection, response, and recovery from a material cybersecurity incident. To address cybersecurity threats, cybersecurity intelligence, as well as responding to cyber-related incidents, we work closely with law enforcement, cybersecurity consulting firms, and industry associations to enhance information sharing and guard against cybersecurity attacks.

companyName: AMEREN CORP

ticker: AEE


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to affect the Company, including our business strategy, results of operations or financial conditions.

companyName: InfuSystem Holdings, Inc

ticker: INFU


text: The Audit Committee of the Company’s Board of Directors is tasked with oversight of the Company’s cybersecurity, information and technology security and data privacy strategies and policies. The Chief Information Officer and/or CISO provide regular updates to the Audit Committee on cybersecurity events, vulnerability management, ransomware readiness, and global cybersecurity trends across industries.

companyName: Phoenix Education Partners, Inc.

ticker: PXED


text: We obtain System and Organizational Controls ("SOC") 1 or SOC 2 reports on an annual basis from vendors that host our significant financial applications to aid in our assessment of information security risk amongst our relationships with the host vendors. We also perform quarterly access reviews for these systems that are subject to Sarbanes-Oxley oversight.

companyName: NATHANS FAMOUS, INC.

ticker: NATH


text: Our incident management processes include reporting to senior management, including the Chief Financial Officer (CFO), Vice President of Regulatory and Quality Assurance, Chief Executive Officer, and GxP Systems Director, and, where appropriate, to the board of directors. To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats that could affect our information or systems. For more information, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.

companyName: Candel Therapeutics, Inc.

ticker: CADL


text: We periodically perform simulations and tabletop exercises with the senior leadership team and incorporate external resources and advisors as needed. As part of those tabletop exercises, we review our Executive Cyber Crisis Management Plan, which is intended to provide senior leadership with operational structure and key considerations in the event of a cybersecurity incident. We also conduct employee training for Cybersecurity through our online learning management systems, regular communications, and other interactive education, such as phishing simulations.

companyName: APi Group Corp

ticker: APG


text: The Company maintains and, at least annually, reviews its information technology ("IT") and cybersecurity policies and procedures (the "Cybersecurity Program"). The Cybersecurity Program is aligned to the National Institute of Standards of Technology Cybersecurity Framework. The Cybersecurity Program includes technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Management has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats.

companyName: CAPITAL SOUTHWEST CORP

ticker: CSWC


text: At the management level, our cybersecurity program is led by the CISO, who is responsible for assessing and managing material risks from cybersecurity threats, including the prevention, mitigation, detection, and remediation of cybersecurity incidents. The CISO is informed about cybersecurity threats and incidents in accordance with the cybersecurity incident response plan as discussed above. The CISO, who reports to the Chief Technology, Data and Analytics Officer, regularly provides updates to the Chair of the Audit Committee and Chief Financial Officer. We also have protocols by which certain cybersecurity incidents are reported promptly to the Chair of the Audit Committee and Chief Financial Officer, as appropriate. The Company's CISO has served in various cybersecurity roles for over 20 years, leading a variety of cybersecurity and risk capabilities and also holds multiple cybersecurity certifications such as Certified Information Systems Security Professional, Certified Information Systems Auditor, and Certified in Risk and Information Systems Control.

companyName: ESTEE LAUDER COMPANIES INC

ticker: EL


text: Finally, we have implemented encrypted virtual private networks in an effort to enhance the integrity of remote connections and have endeavored to protect wireless access points to our systems using authentication of users and/or devices. Segmented networks and user access controls are used to limit unauthorized access to sensitive information and systems. Employees are required to use multi factor authentication and regularly update their passwords.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: The Company's Cybersecurity Plan lays out on-going processes for incident response and prevention, including processes for bettering Company cybersecurity response following any cybersecurity incidents. All employees undergo training to aid in understanding the Company's expectations for safeguarding all data stored on Company cyber networks. In addition to its Cybersecurity Plan, the Company has established risk management guidelines (the "Risk Management Guidelines") that address the Company's response to risks, including a cybersecurity incident. The Risk Management Guidelines describe the Company's policy of managing enterprise risk, including external risks arising from cybersecurity threats and provide that the audit committee of the Board (the "Audit Committee") will coordinate with and assist the Board in its oversight of risk.

companyName: Verano Holdings Corp.

ticker: VRNO


text: As an externally managed company, the Company relies on our Manager's corporate information technology, accounting and financial reporting platforms, enterprise applications and related systems (the "Information Systems") in connection with the Company's day-to-day operations. Pursuant to an administrative services agreement, our Manager in turn relies on the Information Systems of TCG Services LLC, an affiliate of our Manager, to fulfill its obligations to the Company. Our Manager has adopted a written information security program (the "Written Information Security Policy"), which is designed to address applicable requirements under Regulation S-P and the FTC Safeguards Rule. Consequently, the Company also relies on the processes for assessing, identifying, and managing material risks from cybersecurity threats under the Manager's Written Information Security Policy. The processes include, among other things, maintaining secure digital or physical access to information assets, using manual and automated detection methods for malicious code, due diligence of third-party vendors, and engaging a leading provider of cybersecurity services to assess and manage cybersecurity risk. For third-party service vendors that perform a variety of important functions for our business, we seek to engage reliable, reputable service vendors that maintain cybersecurity programs.

companyName: Sunrise Realty Trust, Inc.

ticker: SUNS


text: The Company also has in place an Incident Response Plan that enables it to quickly categorize, respond, and escalate to senior leadership and the Audit Committee of the Board, real or potential cybersecurity incidents in a manner designed to mitigate overall business impact.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO


text: Executive Officers of Restaurant Brands International, Inc., General Partner of Registrant Set forth below is certain information about our executive officers as of February 20, 2025.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: The Company performs security awareness training with its employees. Our security policy is also provided to employees upon employment providing them with the rules and policies to follow so that proper security practices are understood and performed.

companyName: Airship AI Holdings, Inc.

ticker: AISP


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: assessments that are designed to help identify material cybersecurity risks to our critical systems and information. security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents. use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls. awareness training of our employees, including our incident response personnel. cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: EDUCATIONAL DEVELOPMENT CORP

ticker: EDUC


text: Our Information Security Policy provides guidance on the requirements necessary to ensure the security of the Company's data, systems, and networks. It applies to all individuals who access IT resources or data processed by the Company. We use commercially reasonable efforts to follow industry standards and best practices, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, for our IT Security Incident Response Plan.

companyName: JACK IN THE BOX INC

ticker: JACK


text: Security starts for our system at the edge of the network. We then build security deeper into the system resulting in interlocking layers designed to strengthen each other. Our information security management system is based on industry-leading frameworks including International Organization Standardization (ISO) 27001, evidenced by our ISO 27001 certification and other audited activities. The ISO 27001 and additional frameworks specify the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a documented Information Security Management System within the context of the organization's overall business risks. It specifies the requirements for the implementation of security controls customized to the needs of individual organizations and addresses confidentiality, access control, vulnerability, business continuity, and risk assessment.

companyName: INTEGRAL AD SCIENCE HOLDING CORP.


text: Management has responsibility for developing and coordinating the Company's cybersecurity policy and strategy, and for managing the prevention, detection, mitigation and remediation of cybersecurity incidents. We utilize various risk assessment tools and technologies to identify potential cyber and information security threats and risks as well as engage with various third parties to assist in program development, risk evaluation and testing. For example, we have implemented a third-party risk assessment process for certain service providers, suppliers, and vendors, which is conducted during the procurement cycle. Critical vendors are assessed on an annual basis. In addition, all team members are required to participate in ongoing training and awareness programs that include periodic assessments to drive adoption and awareness of cybersecurity processes and controls.

companyName: Surgery Partners, Inc.

ticker: SGRY


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. However, we do depend on the digital technologies of third parties, including information systems and infrastructure, and as noted in Item 1A. Risk Factors of this Annual Report on Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose.

companyName: Everest Consolidator Acquisition Corp


text: A core component of our security framework is our threat detection and response capability. We have implemented an extended detection and response system that provides continuous monitoring, real-time threat detection and automated response mechanisms to mitigate cybersecurity risks. Our governance, risk and compliance initiatives have also advanced, with ongoing efforts to standardize security policies and align with regulatory and industry standards. Penetration testing is conducted to assess our security posture and identify potential vulnerabilities, ensuring that our defenses remain resilient against emerging threats.

companyName: ENTRAVISION COMMUNICATIONS CORP

ticker: EVC


text: The Audit Committee of our Board of Directors is responsible for the oversight of our cybersecurity risk management. At least twice per year, our Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO") provide a cybersecurity update to our Audit Committee, which includes the results of penetration testing, cybersecurity simulations and training, as well as key initiatives and the progress against those initiatives, updates on the changes in trends of cybersecurity threats and the steps management is taking to address cybersecurity risks.

companyName: STEELCASE INC


text: Our Manager of Information Technology periodically reports to the Audit Committee and leads the Company's overall cybersecurity function. The Audit Committee receives reports from our IT team on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents.

companyName: TXO Partners, L.P.

ticker: TXO


text: We recognize the importance of managing cybersecurity threats and risks related to our business, and we have adopted a multi-faceted and proactive strategy to identify, evaluate, address, respond and neutralize cybersecurity threats and attacks. We employ a combination of technical solutions, security policies and procedures, employee training programs, and regular security audits to enhance and fortify our defenses. We utilize advanced monitoring tools and anomaly detection systems to swiftly identify any suspicious activities or deviations from normal operation. Our security infrastructure includes firewalls, intrusion detection systems, encryption protocols, and access controls to protect our systems and data from unauthorized access or malicious attacks. In the event a cybersecurity incident is detected, we have established incident response procedures to contain the threat, minimize the impact, and restore normal operations as quickly as possible. We also conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect our information systems that are vulnerable to such cybersecurity threats. We believe that our cybersecurity risk management process has been and continues to be an integral part of our overall risk management process of the Company as our cybersecurity team collaborates closely with our information technology team, senior management, Audit Committee and Cybersecurity Subcommittee, and internal audit team to address any such threats and incidents.

companyName: ALPHA & OMEGA SEMICONDUCTOR Ltd

ticker: AOSL


text: We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on operations and compliance foundations. Operations focus on continuous detection, prevention, measurement, analysis and response to cybersecurity alerts and incidents, and on emerging threats. Compliance establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility and availability of company data stored, processed or transferred. Our cybersecurity program is integrated within our overall risk management processes.

companyName: SOCKET MOBILE, INC.

ticker: SCKT


text: We maintain high standards with respect to cybersecurity, in accordance with regulatory guidelines, contractual requirements and industry practices. Our cybersecurity strategy is aimed to anticipate, detect, and respond to threats, ensuring the resilience and integrity of our operations. We use a risk management process, overseen by our Information Security Officer ("ISO"), that encompasses technical security controls, policy compliance mechanisms, monitoring systems, contractual agreements, and governance. Our cybersecurity risk management process is integrated with our overall enterprise risk management process and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management process to other legal, compliance, strategic, operational and financial risk areas. Key elements of our cybersecurity risk management program include a cybersecurity incident response plan with procedures for responding to cybersecurity incidents and annual data protection and cybersecurity awareness training of our employees who have access to information systems.

companyName: OSI SYSTEMS INC

ticker: OSIS


text: We have an information security training program that includes: monthly awareness articles, a phishing training program (with reports reviewed by the Executive Team), a Security Ambassador program for additional training and awareness for individuals in high risk roles, required and optional training modules in our Learning Management System, and quarterly security-focused podcasts.

companyName: Zoetis Inc.

ticker: ZTS


text: Cybersecurity is critical to preserving our documents and records and enabling us to reach our ultimate goals. Inasmuch as we have no current operations, no customers, no contractors, no supply chains, no current revenue stream, and only one employee, we do not face the multitude of cybersecurity threats common to most companies and most industries. We believe a cybersecurity incident would have a minimum impact on our operations.

companyName: DIAMONDHEAD CASINO CORP

ticker: DHCC


text: The risk management function is led by the General Counsel and Chief Risk Officer ("CRO"), the SVP, Information Technology, the Information Security Officer, and the virtual Chief Information Security Officer ("vCISO") employed by DeepSeas Security, a cyber defense services business that partners with customers to reduce cybersecurity risks and the related costs. The vCISO and the CEO each play a pivotal role in informing the Board of Directors on cybersecurity risks. They provide comprehensive briefings to both the Board and the Audit Committee at least once per year and more frequent as needed. These briefings encompass a broad range of topics, including: The current cybersecurity landscape and emerging threats; The status of ongoing cybersecurity initiatives and strategies; Incident reports and issues identified from any cybersecurity events; and Compliance with regulatory requirements and industry standards.

companyName: Rhinebeck Bancorp, Inc.

ticker: RBKB


text: We also have cybersecurity-specific policies, standards and procedures, and our cybersecurity program aligns with industry standards, including the U.S. National Institute of Standards and Technology ("NIST") cybersecurity framework and International Organization for Standardization ("ISO") information security standards. Our information security management system has achieved ISO 27001:2022 certification. To help ensure the resilience of critical data and systems, maintain regulatory compliance, manage material cybersecurity risks, and protect against, detect and respond to cybersecurity incidents, we regularly undertake the following activities: •24x7x365 security operations monitoring of our systems, networks and services to detect and act on weaknesses and potential intrusions;

companyName: MSCI Inc.

ticker: MSCI


text: We continuously monitor and update our information technology networks and infrastructure to prevent, detect, address and mitigate risks associated with unauthorized access, misuse, computer viruses and other events that could have a security impact. We invest in industry standard security technology to protect the Company's data and business processes against risk of cybersecurity incidents. Our data security management program includes identity, trust, vulnerability and threat management business processes, as well as adoption of standard data protection policies.

companyName: HYPERION DEFI, INC.

ticker: HYPD


text: Innovex maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") and the Cybersecurity Framework. Innovex has an annual assessment, performed by a third party, of the Company's cyber risk management program against the NIST Cybersecurity Framework. Innovex contracts a Cyber Security Operations Center operating in three locations to provide 24/7 monitoring of its global cybersecurity environment and to coordinate the investigation and remediation of alerts. An annual incident response drill is in place to prepare support teams in the event of a significant incident. Cyber partners are a key part of Innovex's cybersecurity infrastructure. Innovex partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. Innovex engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in Innovex's environment.

companyName: Innovex International, Inc.

ticker: INVX


text: The Utilities have a cybersecurity program in place, which is integrated into the overall risk management program and includes a risk management strategy and risk assessment policy, which are disseminated and maintained by the Chief Information Security Officer (CISO), revisited annually and, which govern the enterprise cybersecurity risk and maturity assessment process. The program is aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), and leverages a risk-based approach to optimize its security investment and advance its security program's maturity and security posture over time.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: We periodically assess our risks relating to cybersecurity threats, including risks relating to our reliance on third parties. In so doing, we consider the likelihood and impact that could result from the manifesting of such risks, together with the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: SUI Group Holdings Ltd.

ticker: SUIG


text: In addition, we evaluate critical systems and applications hosted by third parties for cybersecurity risks and we also assess the security posture and features of those services. This includes review and monitoring of the third party, and inclusion of cybersecurity requirements in contractual agreements to ensure third party services meet our standards for such providers, and the cybersecurity risks associated with the use of these services is appropriate.

companyName: Lumentum Holdings Inc.

ticker: LITE


text: In compliance with PRC laws and regulations with respect to data security in all material aspects, we have implemented comprehensive internal policies and measures on protection of cyber security, data privacy and personal information as listed above.

companyName: ENTREPRENEUR UNIVERSE BRIGHT GROUP

ticker: EUBG


text: Our Board as a whole has responsibility for the Company's risk oversight, with reviews of certain areas being conducted by the relevant Board committees that report on their deliberations to the full Board. The oversight responsibility of the Board and its committees is enabled by management reporting processes that are designed to provide visibility to the Board about the identification, assessment and management of critical risks and management's risk mitigation strategies.

companyName: Main Street Capital CORP

ticker: MAIN


text: Certain employees of Greystone Manager that provide services to the Partnership are responsible for assessing and managing material risks from cybersecurity threats and are overseen by the Partnership's Chief Financial Officer. The Chief Financial Officer and relevant Greystone Manager employees collectively have over 20 years of experience in information technology risk assessment and audit evaluations. These individuals will also consult with experts from Greystone's affiliate that provides information technology managed services systems, particularly the Chief Information Security Officer ("CISO") of the Greystone affiliate, when assessing and evaluating risks of cybersecurity threats. These consultations with the CISO typically encompass a broad range of topics, including the current cybersecurity landscape and emerging threats; the status of ongoing cybersecurity initiatives and strategies; incident reports and learnings from any cybersecurity events; and compliance with regulatory requirements and industry standards.

companyName: Greystone Housing Impact Investors LP

ticker: GHI


text: Risk Management and Strategy IT systems and networks are important to our business operations, and we are committed to protecting the privacy, security, and integrity of our data, inclusive of our employee and customer data. We have a comprehensive cybersecurity program in place that is responsible for identifying, preventing, and mitigating data security risks. This program is aligned with the Company's overall Enterprise Risk Management process.

companyName: J M SMUCKER Co

ticker: SJM


text: Our Incident Response Team, in coordination with external advisors, is responsible for responding to and managing cybersecurity incidents pursuant to our Incident Response Plan. Our Incident Response Team includes our Cybersecurity Team and our Chief Executive Officer, along with other Company personnel as appropriate based on the nature of the incident.

companyName: Granite Point Mortgage Trust Inc.

ticker: GPMT


text: We recognize the importance of maintaining the confidence and trust of our customers, suppliers, employees, audience, and communities by maintaining our data and information security. In managing our cyber risk, we utilize the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (the "NIST Framework") issued by the U.S. government as a guideline to manage our cybersecurity-related risk. In addition, we have established security control requirements for our third party vendors based on global standards.

companyName: NEXSTAR MEDIA GROUP, INC.

ticker: NXST


text: Company's cybersecurity policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats and responding to cybersecurity incidents are integrated into the Company's risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology. The Company has established controls and procedures, including an Incident Response Plan, that provide for the identification, analysis, notification, escalation, communication, and remediation of data security incidents at appropriate levels so that so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. In particular, the Company's Incident Response Plan (i) is designed to identify and detect information security threats through various mechanisms, such as through security controls and third-party disclosures, and (ii) sets forth a process to (a) analyze any such threats detected within the Company's IT environment or within a third-party's IT environment, (b)

companyName: SKYX Platforms Corp.

ticker: SKYX


text: Monitor Cybersecurity Incidents The CISO is responsible for informing himself from appropriate sources about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CISO implements and oversees processes for the monitoring of our information systems. This includes the deployment of security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions designed to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: CYTOKINETICS INC

ticker: CYTK


text: While neither the Sponsor nor the Trust has experienced a material cybersecurity incident, cybersecurity threat risks may materially affect either the Sponsor or the Trust, including the Trust's business strategy, results of operations or financial condition.

companyName: Bitwise Bitcoin ETF

ticker: BITB


text: Our Chief Information Officer ("CIO"), our Vice President of Information Security (who serves as our Chief Information Security Officer ("CISO")), and the Company's information security function help identify, assess and manage the Company's cybersecurity threats and risks. This team identifies and assesses risks from cybersecurity by monitoring and evaluating our threat landscape and the Company's risk profile using various methods, including, for example, manual and automated tools in certain environments and systems, subscribing to threat intelligence reports and services, scanning our environment for certain threats, evaluating our risk exposure, evaluating and analyzing certain reported threats, collaborating with law enforcement on certain threat intelligence, conducting internal and external cybersecurity audits, performing threat assessments in certain environments and systems, conducting vulnerability assessments in certain environments and systems, and engaging third-party experts for red/blue team testing and tabletop incident response exercises.

companyName: Veritone, Inc.

ticker: VERI


text: Board is ultimately responsible for overseeing cybersecurity, information security, and information technology risks, as well as management's actions to identify, assess, mitigate, and remediate those risks. As part of its program of regular risk oversight, the Audit Committee assists the Board in exercising oversight of the Company's cybersecurity, information security, and information technology risks.

companyName: Prairie Operating Co.

ticker: PROP


text: IT Team Director regularly meets with the Chief Financial Officer and as appropriate the Chief Executive Officer to discuss cybersecurity risks. This ensures that management is informed about our current cybersecurity measures and aware of any potential risks facing our operations. In the event of a cybersecurity incident, we have put in place a reporting structure to inform the Chief Financial Officer, Chief Executive Officer and General Counsel promptly of any incident so that they may assess the appropriate response to the incident and any reporting concerns that may be triggered by the incident.

companyName: MICROVISION, INC.

ticker: MVIS


text: The Company's Enterprise Risk Management Team (the "ERM Team") works in collaboration with the Company's Information Security Team to set the enterprise risk strategy and make risk-informed decisions, which include the assessment and response to cybersecurity risk. The Company maintains an information security, technology, and cybersecurity risk management program overseen by the Chief Information Security Officer (the "CISO") that uses a risk-based methodology to support the security, confidentiality, integrity, and availability of its information. The Company's information security, technology, and cybersecurity risk management program provides the structure for managing the respective risks utilizing a combination of automated tools, documented processes, and third-party assessments to identify and assess potential cybersecurity risks. The Company engages third parties in connection with its cybersecurity program. Third party monitoring activities include the use of Security Information Event Monitoring ("SIEM") software and regularly scheduled vulnerability assessments performed by an independent third-party to capture and identify vulnerabilities, security events, and potential incidents. The Company also maintains a formal information security training program that includes training on matters such as phishing and email security best practices as well as data privacy which is required for all employees on an annual basis.

companyName: ModivCare Inc

ticker: MODVQ


text: To date, we have not encountered cybersecurity threats or challenges that have materially impaired our operations, business strategy or financial condition..

companyName: Texas Mineral Resources Corp.

ticker: TMRC


text: Our cybersecurity program is managed and implemented by a team of enterprise level and business unit level information security professionals, partnering with third party advisory services, as needed. The team's focus is on our operational response to cybersecurity threats, exposure analysis, security governance and the design and implementation of our security controls. Our Incident Response Plan, developed by management, governs our process to respond to, remediate and resolve material cybersecurity incidents, including providing appropriate internal and external communication of such incidents.

companyName: MASCO CORP /DE/

ticker: MAS


text: Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems. For example, third parties conduct assessments, such as vulnerability scans, penetration testing, and overall risk assessments, and third-party tools are utilized to identify potential vulnerabilities. The Company employs a variety of processes to address cybersecurity threats related to third-party technology and services, including privacy, solution and vendor risk assessments, imposition of contractual obligations, and performance monitoring. The Company also relies on services provided by Kellanova, a third-party entity, through a Transition Service Agreement (TSA). This agreement ensures the seamless continuation of essential operations during transitional phases.

companyName: WK Kellogg Co


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our IT Director and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.

companyName: CHICAGO RIVET & MACHINE CO

ticker: CVR


text: As appropriate, the board of directors also receives information regarding cybersecurity incidents as well as ongoing updates regarding mitigation of any such incidents until they have been resolved.

companyName: HUBSPOT INC

ticker: HUBS


text: We do not believe that risks from cybersecurity threats of which we are currently aware, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see "A cyber-attack or security breach could cause a loss of confidential consumer data, give rise to remediation and other expenses, expose us to liability under privacy laws, consumer protection laws, common law and other legal theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, result in interruptions or delays to services, adversely impact our financial results, and otherwise be disruptive to our business" included in Part I, Item 1A of this Form 10-K.

companyName: Addus HomeCare Corp

ticker: ADUS


text: We operate a cybersecurity program and governance framework designed to protect our computing environments against cybersecurity threats, and we have controls, policies, and procedures to identify, manage, and mitigate cybersecurity threats. Annually, we assess our cybersecurity program's alignment with the National Institute of Standards & Technology's Cyber Security Framework ("NIST") and other applicable industry standards. We also undertake integrated planning and preparedness activities to support business continuity and operational resiliency. We assess our program's effectiveness through various exercises, including tabletop simulations and production environment tests, penetration and vulnerability tests, red team exercises, and other related activities. We conduct mandatory cybersecurity training, provide employees with tools to report suspected incidents and assess their own security posture, and conduct real-time simulated employee education exercises, such as phishing email campaigns designed to emulate real-world attacks. We also engage in robust cybersecurity assessments and remediation efforts for acquired companies.

companyName: MICROSOFT CORP

ticker: MSFT


text: Our Vice President of IT leads our dedicated Information Technology team ("IT team"), which executes on our data privacy and information security programs and policies, and our Cyber Incident Response Team ("IRT"), which executes on our incident response procedures in the event of a data privacy or security event and conducts annual exercises simulating cybersecurity and data breach incidents. The IRT is comprised of internal members from the finance, legal, human resources, and operations departments, as well as external cybersecurity vendors and advisors. The members of our IRT understand the complexities of our business and are experienced in the financial, legal, regulatory and operational consequences of a cybersecurity incident or threat to the Company.

companyName: Shoals Technologies Group, Inc.

ticker: SHLS


text: The day-to-day management of cybersecurity is the responsibility of our Senior Vice President, Chief Information Officer, who oversees our Information Technology ("IT") team. The Chief Information Officer reports directly to the Chief Financial Officer. Our Senior Vice President, Chief Information Officer ("CIO") has served in this role for over seven years, and has more than 20 years of experience in the aggregate in various roles involving managing information security, technology infrastructure, IT operations, and developing cybersecurity strategy. Together with his IT team and external consultants, our CIO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management processes described below, including the operation of our cybersecurity incident response plan.

companyName: COUSINS PROPERTIES INC

ticker: CUZ


text: Our cybersecurity risk management processes are integrated into our overall risk management system through our risk management committee structure. These committees have processes to help facilitate appropriate and effective oversight of cybersecurity risk, including tracking and reporting of cybersecurity risks and remediation plans. The Bank maintains a chartered Technology Committee, which is responsible for the oversight of policies and practices relating to the identification, assessment, measurement, monitoring and management of our technology and information security risks. The Technology Committee is chaired by our Chief Technology & Information Security Officer and members include two members from our Board of Directors, one independent Director and the President, Chief Financial Officer, Chief Banking Officer, IT Infrastructure & Security Manager, and officers of key business systems. The Chief Technology & Information Security Officer reports the cyber security status of the Bank to our Board of Directors on a monthly basis. These reports include performance metrics, security events, penetration testing, training, audit results, new system and vulnerability assessments and the identification and remediation of cybersecurity risks. The Information Security Officer also provides information regarding the threat environment and our efforts to detect, prevent and respond to internal and external critical threats The Board of Directors, leveraging the efforts of the Technology Committee, oversees our continuing efforts to strengthen our information security infrastructure and staffing, adhere to regulatory guidelines and enhance our processes, technology controls and cybersecurity defenses. Our Chief Technology & Information Security Officer regularly reports to the Board of Directors on security matters, our Risk Management Committee establishes and reviews key cyber risk indicators and performance metrics, and our Technology Committee assesses and disseminates periodic updates on information security risk, the maturity of our information security program, and related investments and results.

companyName: FVCBankcorp, Inc.

ticker: FVCB


text: The Company has adopted a cybersecurity risk management program that includes processes designed to identify, assess, manage, and monitor risks from cybersecurity threats. We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity awareness and risk management. Those processes include conducting an assessment of internal and external threats to the security, confidentiality, integrity and availability of Company data and systems along with other material risks to Company operations, at least annually or whenever there are material changes to the Company's systems or operations and responding to risks identified. The Company uses NIST cybersecurity and risk management frameworks to assess its cybersecurity controls, risks, and overall program effectiveness. As part of our risk management process, the Company also engages outside providers to conduct periodic internal and external penetration testing and security assessments. As part of our third-party risk management program, we conduct assessments of vendor cybersecurity risks, including risks associated with our cloud vendors and other third parties.

companyName: NOVAVAX INC

ticker: NVAX


text: Our VP IT leads our information technology and cybersecurity function, including the role of Chief Information Security Officer ("CISO"), since early 2022. Our VP IT holds a Bachelor of Science in Cybersecurity and Information Assurance and is a systems security certified practitioner ("SSCP"). Our VP IT has served in various roles in information technology for over 25 years, including as vice president of a major cybersecurity company, where he directly oversaw the technical operations and cybersecurity. The VP IT oversees information security resources designed to assess and manage cybersecurity threats on a day-to-day basis.

companyName: Astra Space, Inc.


text: In the event of a cybersecurity incident, we have an incident response plan that includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. The cybersecurity and product security teams routinely practice this plan with functions across the organization. We conduct tabletop exercises with senior management, during which we practice the procedures in place to ensure that potentially material cybersecurity risks and incidents are escalated to management and the Board of Directors where applicable.

companyName: STRYKER CORP

ticker: SYK


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Investment Adviser and other third-party service providers. The Investment Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Brightwood Capital Corp I


text: Since the beginning of the last financial year, we have identified and prevented risks from known cybersecurity threats that have not had any material affected on the business. For a discussion of how cybersecurity risks could materially affect us in the future, please see the risk factors set forth under the caption Part I, Item 1A, Risk Factors.

companyName: Pacific Green Technologies Inc.

ticker: PGTK


text: For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy and results of operations, see "Risk Factors – "Risks Related to Data Protection Privacy, Cybersecurity, Intellectual Property and Technology" which is incorporated by reference into this Item 1C.

companyName: Evolent Health, Inc.

ticker: EVH


text: We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use various inputs in such random risk assessments, including information supplied by providers and third parties.

companyName: PGT Innovations, Inc.


text: Material Impact of Cybersecurity Risks As of the date of this annual report on Form 10-K, we are not aware of any material risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about the cybersecurity risks that we face is discussed in Item 1A of Part I, "Risk Factors" in this annual report on Form 10-K under the heading "The failure in cybersecurity systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively."

companyName: MONROE CAPITAL Corp

ticker: MRCC


text: Our Senior Vice President, Chief Business Officer and Head of Commercial Operations is responsible for the strategic leadership and direction of our cybersecurity program. The Senior Vice President, Chief Business Officer and Head of Commercial Operations has nearly 10 years of experience overseeing information technology activities.

companyName: TREVENA INC


text: identified any known cybersecurity threats, including prior incidents, that have materially affected or are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. However, we recognize that cybersecurity threats pose ongoing risks which, if realized, could have a material adverse impact on our business, financial condition and results of operations.

companyName: Hour Loop, Inc

ticker: HOUR


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including controls, systems and processes that we have or will in the future implement, will be fully implemented, complied with or effective in protecting our systems and information. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See our risk factor titled "Our business could be negatively affected by security threats and disruptions, including electronic, cybersecurity or physical security threats, incidents and other disruptions."

companyName: Tamboran Resources Corp

ticker: TBN