text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for oversight of our risk management framework, which is designed to monitor and manage strategic and operational risks. Management is responsible for the day-to-day identification, assessment and management of risks in our operations, including cybersecurity risks. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.

companyName: Upstart Holdings, Inc.

ticker: UPST


text: We recognize the importance of assessing, identifying, and managing risk associated with cybersecurity threats. Our external advisor has implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such risks. Our advisor has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: New York REIT Liquidating LLC

secItem: Item 1C


text: Our cybersecurity programs, including the cross-functional management committees described above are the responsibility of our Chief Information Security Officer. Day-to-day administration of the cybersecurity programs are led by our Chief Information Security Officer and Chief Product Security Officer who collectively possess significant experience related to cybersecurity issues in both the private and government sectors, and possess certifications including but not limited to Certified Information Systems Security Professional ("CISSP") and Certified Information Security Manager ("CISM").

companyName: CARRIER GLOBAL Corp

ticker: CARR


text: Our cybersecurity program is led by our director of information technology (IT), who is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our director of IT has extensive information technology and program management experience and leads a team that has many years of experience with our organization. Our director of IT reports to our vice president in charge of coordinating operational activities within our business segments. Our cybersecurity risks are also reviewed and tested annually through third party assessments and internal and external information technology audits. Our information technology team reviews enterprise risk management level cybersecurity risks annually.

companyName: COMPX INTERNATIONAL INC

ticker: CIX


text: Risk Management and Security As a diversified healthcare services leader that is dedicated to advancing health outcomes for patients everywhere, cybersecurity risk management is integral to our enterprise risk management strategy. Our management, with involvement and input from external consultants and oversight from our Board of Directors ("Board"), performs an annual enterprise-wide risk assessment ("ERA") to identify key existing and emerging risks. One of the principal risks identified and assessed through this process is cybersecurity, which remains a key focus for the Company, management, and our Board.

companyName: MCKESSON CORP

ticker: MCK


text: Our management team, including our Chief Executive Officer, our Chief Legal Officer and our Executive Director, IT Infrastructure & Information Security, is responsible for assessing and managing our risks from cybersecurity threats. Certain members of our management team are part of our Cyber Incident Response Team and are responsible for executing the processes set forth therein, including with respect to our key third party service providers. Cybersecurity events are escalated to the Audit Committee or to our Board as appropriate. Our Executive Director, IT Infrastructure & Information Security, has close to thirty years of experience in information security, including twenty years of experience building and leading information security teams, and has held Certified Information Systems Security Professional certification from the International Information System Security Certification Consortium since 2002, as well as Qualified Technical Expert certification from the Digital Directors Network. Our Chief Executive Officer has thirty years of experience overseeing information technology, or IT, functions and has eight years of experience serving on the audit committees of companies that had oversight responsibility of the company's cybersecurity risk management program. Our Chief Legal Officer has overseen our IT team since 2023. Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: Zentalis Pharmaceuticals, Inc.

ticker: ZNTL


text: Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our third-party IT service provider who reports to our Chief Technology Officer, to manage the risk assessment and mitigation process.

companyName: Verde Clean Fuels, Inc.

ticker: VGAS


text: Material Affects of Cybersecurity Incidents Except as disclosed in Part I, Item 1A, “Risk Factors” of this Annual Report on Form 10-K, including, without limitation, the risk factor under the heading “If our internal information technology systems, or those used by our CROs, CMOs, clinical sites or other contractors or consultants upon which we rely, are or were compromised, become unavailable or suffer security breaches, loss or leakage of data or other disruptions, we could suffer material adverse consequences resulting from such compromise, including, but not limited to, operational or service interruption, harm to our reputation, litigation, fines, penalties and liability, compromise of sensitive information related to our business, and other adverse consequences”, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.

companyName: Kyverna Therapeutics, Inc.

ticker: KYTX


text: In the ordinary course of our business, we may produce, store and process sensitive data. To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management program which is comprised of data segregation, physical, procedural, and technical safeguards along with policies and procedures. We have substantially outsourced our IT environment and utilize expert third party software-as-a-service providers for our financial accounting, human resource management, payroll and benefits functions. We also substantially outsource the conduct of our clinical programs and the associated IT infrastructure to expert third party CROs. As a result, the primary means by which we avoid cyber risk is minimizing the sensitive data within our own enterprise.

companyName: Coya Therapeutics, Inc.

ticker: COYA


text: Cybersecurity Risks The Company is currently not aware of any material cybersecurity incidents or threats that have impacted the Company or its business, financial condition, results of operations, employees, or customers in the past fiscal year. However, the Company and its customers routinely face risks of cybersecurity incidents, wholly or partially beyond the Company's control, as the Company relies heavily on information technology systems. Although the Company makes efforts to maintain the security and integrity of the Company's information technology systems, these systems and the proprietary, confidential internal and customer information that resides on or is transmitted through them, are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that the Company's security efforts and measures and those of the Company's third- party providers will prevent breakdowns or incidents affecting the Company's or the Company's third-party providers' databases or systems that could adversely affect the Company's business. For a discussion of these risks, see "Item 1A Risks Related to the Company's Information Technology, Cybersecurity and Data Protection."

companyName: ROBERT HALF INC.

ticker: RHI


text: The Company's Chief Information and Digital Officer has formal education in information technology and more than 30 years of experience in information systems and technology, including as the vice president of Global Information Technology. Prior to joining Dow, the Chief Information and Digital Officer held a variety of leadership roles including vice president of Information Technology at Cargill, Incorporated. The Chief Information and Digital Officer receives regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation.

companyName: DOW INC.

ticker: DOW


text: The CISO, CIO, CRO, CFO, CAO, and General Counsel comprise the MAT. Other SMEs or technical experts may advise, consult with and provide information to the MAT as needed. In addition to the specific subject matter expertise and experience of the CISO and CIO, these executives have broad financial, legal, risk management, industry, regulatory and SEC compliance, and general leadership experience, which enable the MAT to effectively carry out its responsibilities.

companyName: BankUnited, Inc.

ticker: BKU


text: We undertake to align our cybersecurity program, which encompasses both enterprise security and operational security, with the standards of the National Institute of Standards and Technology Cybersecurity Framework. We maintain continuous cyber threat-detection systems and have established an incident response plan, which contains playbooks for addressing and recovering from potential material cyberattacks and breaches of data security. In addition to establishing security measures for vendors, we require onboarding orientation and periodic training for all employees and board members that focuses on cybersecurity and information management, and we conduct regular cybersecurity awareness campaigns.

companyName: Transocean Ltd.

ticker: RIG


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats in 2024 that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Risk Factors—Risks Related to Compliance Matters—Aspects of our business are subject to privacy, data use and data security regulations, which could increase our costs" and "—Risks Related to Our Business and Industry—We rely on our information technology systems to manage numerous aspects of our business and a disruption of these systems could adversely affect our business."

companyName: Velo3D, Inc.

ticker: VELO


text: We engage third-party consultants to conduct cybersecurity assessments and help mature the information security program. We regularly review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our board of directors, and we may adjust our cybersecurity program and practices as necessary based on the information provided by these assessments, audits and reviews. We review and test our information security systems, including regular penetration tests of our network. We also use third-party systems to monitor our information security continually.

companyName: Cottonwood Communities, Inc.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our enterprise operations, compliance, and legal teams, including our Chief Information Officer, Chief Information Security Officer, and Chief Legal Officer. Such individuals have extensive prior work experience in various roles involving information technology, including security, auditing, compliance, systems, and programming. These individuals are informed about, and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.

companyName: Jamf Holding Corp.

ticker: JAMF


text: The Company's senior IT leadership, comprised of the Chief Information Officers of both AMC and Odeon, and IT cybersecurity teams have the primary responsibility for assessing, monitoring, and managing, our cybersecurity programs. The Company's senior IT leadership bring over fifty years of combined IT experience to their roles. Each member of the Company's IT cybersecurity leadership team, comprised of the AMC Director Cybersecurity, the Odeon Group Head of Cyber, Risk and Operations and the AMC SVP & Chief Information Officer, brings 20+ years of IT experience. The Company regularly invests in training on these teams, and key leadership positions hold CISSP certifications. Our senior IT leadership and IT cybersecurity team, with input as appropriate from the Security Committees, oversee our governance programs, tests our compliance with standards, remediate known risks, and direct employee training.

companyName: AMC ENTERTAINMENT HOLDINGS, INC.

ticker: AMC


text: The Managing Director, Information Technology, works closely with other management positions, including our Chief Financial Officer and our General Counsel, to help us maintain an effective incident response communication plan and understanding of our cybersecurity risk management processes. Our cybersecurity incident response plan provides processes for escalation if there is an emerging cybersecurity incident, including timely notice to our Board of Directors if the incident is deemed material or as otherwise appropriate.

companyName: Chord Energy Corp

ticker: CHRD


text: Our CIO and CISO communicate directly with members of the Audit Committee and Board of Directors on cybersecurity matters. In 2024, our CIO and CISO presented updates on our cybersecurity initiatives quarterly; twice to our Audit Committee and twice to our full Board.

companyName: NVR INC

ticker: NVR


text: Through October 2024, the Director of Global Information Systems had oversight responsibilities for PLP's information systems and cyber security, a role he held for 15 years. He attended regular education programs regarding enterprise cybersecurity and supporting technologies. The Director of Global Information Systems reported to the CFO and coordinated with the IT resources across all subsidiary operations to discuss risk management initiatives, testing and training, recent trends and technological developments, and periodic reviews of third-party providers. In October 2024, the Director of Global Information Systems left the Company to pursue other opportunities. During the interim period before a replacement was appointed, the CFO provided more active oversight to address the Director of Global Information System's responsibilities, including reporting to the Audit Committee. The vacancy was filled on February 3, 2025 and the new Director of Global Information Systems joined the Company with over 30 years of professional IT experience where he held Director and Chief Information Officer roles at large global companies and provided technology consulting and cybersecurity services to companies across various industries.

companyName: PREFORMED LINE PRODUCTS CO

ticker: PLPC


text: Specific Cybersecurity Measures Microvast has implemented various cybersecurity measures, including, but not limited to the following: • Establishing physical security protocols and securing network access via VPN. • Requiring multi-factor authentication for email and collaboration platforms. • Deploying endpoint detection and response (EDR) and antivirus solutions across all devices. • Enforcing strong password policies with a secured password vault for system credentials. • Minimizing attack vectors by eliminating external web-facing business-critical applications. • Utilizing encryption technologies to safeguard intellectual property and mitigate data loss risks. • Developing a comprehensive suite of information security policies and a strategic information security roadmap. • Implementing a Security Information and Event Management (SIEM) system.

companyName: Microvast Holdings, Inc.

ticker: MVST


text: Even though, to date, cybersecurity risks have not materially affected our business or our results of operations, we face numerous and evolving cybersecurity threats. There can be no assurance that we, or the third parties with which we interact, will not face a cybersecurity incident in the future that will materially affect us. For more information about the cybersecurity risks we face, see the risk factor entitled "We rely significantly on information technology to operate our business, including our supply chain and retail operations, and any failure, inadequacy or interruption of that technology could harm our ability to effectively operate our business" in Item 1A. Risk Factors.

companyName: NIKE, Inc.

ticker: NKE


text: We have not identified any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For a full discussion of risks from cybersecurity threats, see the section entitled "Risk Factors" in Item 1A.

companyName: Fidelity National Information Services, Inc.

ticker: FIS


text: Our cybersecurity risk management program includes: risk assessments performed internally and with the help of third party vendors that are designed to help identify material cybersecurity risks to our critical systems, information, products, services, equipment, and our broader enterprise IT and customer-facing network environments;

companyName: ATN International, Inc.

ticker: ATNI


text: Through the Provider, automated security tools are used to monitor all Windows-based systems and provide defense against cyberattacks perpetrated on or against these systems and to protect internal systems from known and unknown cybersecurity threats. These security tools include: • Advanced, next-generation endpoint security software, which detects attempted attacks on internal Windows-based systems and analyzes the attack providing context for said attacks to analysis teams. This data is then used to mitigate the attack and resolve the incident. • Privilege management software, which provides application context to reviewers to aid in the preemptive identification of malicious activities on a system. When administrative permissions are requested, details regarding the requesting process are forwarded to our provider for review and analysis before granting administrative privileges, limiting an attacker's ability to affect and compromise systems in the environment. • Email security tools provided and managed by our Provider, which protect against email-based attacks. These tools include an email security gateway and an additional automated email filtering security. These tools provide advanced, AI-powered phishing detection and remediation for all Microsoft 365 email users in the environment.

companyName: RESERVE PETROLEUM CO

ticker: RSRV


text: We assess, identify and manage risks from cybersecurity threats through our Global Cybersecurity and Compliance Program (Cybersecurity Program). Cybersecurity risks identified in the Cybersecurity Program are integrated into our Enterprise Risk Management Program. In addition, the Cybersecurity Program seeks to incorporate consideration of cybersecurity risk into our product development, business strategy, financial planning and capital allocation decisions.

companyName: BAXTER INTERNATIONAL INC

ticker: BAX


text: Mr. Benavides joined Chegg in 2024 and has served various roles in information technology and security for over 25 years, including serving as CISO of a mortgage servicing company prior to joining Chegg. Mr. Benavides holds an undergraduate degree in Information Technology with a specialization in Information Assurance and Security and was a distinguished graduate of the US Air Force Secure Communications school. Mr. Geiger holds an undergraduate degree in computer science and has served in various roles in information technology for over 30 years, including serving as either the CTO or Executive Vice President of Technology of four companies prior to joining Chegg. Our CEO, CFO and General Counsel each hold degrees in their respective fields, and each have over 20 years of experience managing risks at Chegg and other companies, including risks arising from cybersecurity threats.

companyName: CHEGG, INC

ticker: CHGG


text: CFO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CFO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CFO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: BIOXYTRAN, INC

ticker: BIXT


text: We have an incident response plan under which certain cybersecurity incidents are escalated within the Company to senior executives on the cybersecurity risk management committee, and, where appropriate, reported to the board of directors and audit committee in a timely manner. At the management level, our cybersecurity risk management committee, comprised of senior executives representing functional and business areas, including our legal team, has broad oversight of the Company's risk management processes. Members of the Company's cybersecurity risk management committee includes certain IT leadership and the General Counsel. The committee meets regularly to discuss the risk management measures implemented by the Company to help identify and mitigate data protection and cyber security risks. Certain IT leadership and the General Counsel attend each cybersecurity risk management committee meeting to report on ongoing cybersecurity matters. Our IT leadership also works closely with our legal team to oversee compliance with legal, regulatory and contractual security requirements.

companyName: Leslie's, Inc.

ticker: LESL


text: As of December 30, 2023, we are not aware of any material cybersecurity incidents that impacted the Company or are reasonably likely to impact the Company materially. However, we have been the target of cyber attacks and expect them to continue as cybersecurity threats rapidly evolve in sophistication and become more prevalent in the industry. We face risks of incidents, whether through cyberattacks or cyber intrusions through the Cloud, the Internet, phishing attempts, ransomware and other forms of malware, computer viruses, email attachments, extortion, and other scams.

companyName: WK Kellogg Co


text: To ensure that cybersecurity risk management is integrated into the Company's overall risk management plans, systems and processes, management provides regular cybersecurity reports to the Board of Directors on a monthly basis. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and updates on the emerging threat landscape. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Board.

companyName: William Penn Bancorporation


text: We maintain internal resources to perform penetration testing designed to simulate evolving tactics and techniques of real-world threat actors, engage with industry partners and law enforcement and intelligence communities and conduct tabletop exercises and periodic risk interviews across our business. We also engage an independent third party to perform internal and external penetration testing of Chipotle's information security environment periodically and engage other third parties to periodically conduct assessments of our cybersecurity capabilities. In addition, we continue to expand training and awareness practices to mitigate risk from human error, including mandatory computer-based training and internal communications for employees. Our employees undergo cybersecurity awareness training and regular phishing awareness campaigns that are based upon and designed to emulate real-world contemporary threats. We provide prompt feedback (and, if necessary, additional training or remedial action) based on the results of such exercises.

companyName: CHIPOTLE MEXICAN GRILL INC

ticker: CMG


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from IT personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Global Net Lease, Inc.

ticker: GNL


text: Cybersecurity oversight is managed by our IT Director, who is responsible for evaluating risks and implementing security measures. We do not have a dedicated board committee for cybersecurity, but executive leadership is informed of cybersecurity matters as needed.

companyName: BIOREGENX, INC.

ticker: BRGX


text: While no material cybersecurity incidents have been identified during the reported fiscal year, the Company acknowledges the ongoing and evolving nature of cyber threats and remains vigilant in its efforts.

companyName: California BanCorp \ CA

ticker: BCAL


text: Our cybersecurity program is focused on the following areas: • Governance: We leverage multiple cybersecurity frameworks (e.g., ISO 27001 and NIST CSF) and regulatory requirements to inform our externally managed information technology ("IT") infrastructure. Policies for IT use and management for each employee are part of the employee onboarding process and those policies are refreshed periodically as threats emerge that could be relevant to our IT infrastructure. • Technical Safeguards: The Company does not use a centralized server where all information is stored and therefore where all information is placed at risk. Instead, we deploy technical and procedural measures using a distributed model so that no one location or machine could cripple the company's IT infrastructure. Protection measures include network firewalls, network intrusion detection and prevention, penetration testing, vulnerability assessments and monthly risk assessments and management, threat intelligence, anti-malware and access controls, plus data loss prevention and monitoring. • Security Awareness / Training: All employees are required to adhere to our Standards of Business Conduct, which identifies an employee's responsibility for information security. We also disseminate security awareness information periodically throughout the year. • Third-Party Suppliers and Service Providers: We manage our IT infrastructure with an external vendor who maintains and evaluates risk exposure in real-time and conducts monthly risk assessments and adjustments to preclude cyberattacks. Vendor security reviews evaluate numerous key security controls and the outputs of these reviews are used as part of business decisions regarding storage and dissemination of virtual data and to assess a vendor's overall security posture.

companyName: Inhibikase Therapeutics, Inc.

ticker: IKT


text: Our Board is responsible for the oversight of risks from cybersecurity threats and directly oversees our cybersecurity policies and practices, internal controls regarding information security, and compliance with legal and regulatory requirements regarding cybersecurity risks. The Board receives regular reports and updates on cybersecurity matters from our management, including developments on existing and new cybersecurity risks and how management is addressing and/or mitigating such risks, cybersecurity and data privacy incidents (if any), the status of key information security initiatives, vulnerability assessments, as well as on existing and emerging threat landscapes. Additionally, on at least an annual basis, the Board reviews and discusses with management our policies and programs with respect to cybersecurity threats.

companyName: TPT GLOBAL TECH, INC.


text: Our internal processes, and controls are designed to contain, mitigate, or resolve cybersecurity incidents. As of the report date, risks from cybersecurity threats have not materially affected our company. For further discussion of risks from cybersecurity threats, see the section captioned "System Failure, Cybersecurity Breaches, Fraud and Employee Misconduct Could Subject the Company to Increased Operating Costs, as Well as Litigation and Other Potential Losses" in Item 1A. Risk Factors.

companyName: CITY HOLDING CO

ticker: CHCO


text: The Sponsor has established a risk-based cybersecurity framework for the Funds to manage cybersecurity risks. This framework includes regular assessments of its information systems, physical and virtual infrastructure, and the data therein, to identify potential cybersecurity threats and vulnerabilities. This cybersecurity strategy is integrated into the Funds' overall risk management processes, with specific consideration given to the confidentiality, integrity, and availability of our information systems.

companyName: Amplify Commodity Trust

ticker: BDRY


text: In fiscal 2024, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors— Risks Related to Our Business and Industry" in this annual report on Form 10-K.

companyName: CrowdStrike Holdings, Inc.

ticker: CRWD


text: There have been an increasing number of cyberattacks on companies around the world, which have caused operational failures, compromised sensitive corporate or customer data, and/or resulted in significant financial damages. These attacks have occurred over the internet, through malware, viruses or attachments to e-mails, or through inside actors with access to systems within an organization.

companyName: Safe Pro Group Inc.

ticker: SPAI


text: Our Chief Financial Officer and Chief Operating Officer are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.

companyName: Oruka Therapeutics, Inc.

ticker: ORKA


text: We recognize that third parties that provide information systems used by the Advisor to provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To mitigate third party risk, Franklin Templeton maintains a vendor code of conduct, which is designed to require third party vendors to comply with our requirements for maintenance of passwords, as well as other confidentiality, security, and privacy procedures. All third party vendors must complete a cyber incident reporting questionnaire to ensure timely notification of any potential cybersecurity breaches. Third-party IT vendors are also subject to additional diligence requirements.

companyName: Franklin BSP Real Estate Debt BDC


text: The DITSC is the Company's management position with primary responsibility for the development, operation, and maintenance of our information security program. The DITSC offers over 20 years in cybersecurity expertise, cultivated through service in the United States Air Force and subsequent roles in both public and private sectors across diverse industries. The DITSC has obtained multiple industry specific certifications, including the Certified Information Systems Security Professional and Certified Information Security Manager. The DITSC briefs the Technology Committee of the Board regularly and oversees regular cybersecurity training and education opportunities for the Board, which covers topics ranging from the current threat landscape to our cybersecurity program metrics, risks, and roadmap. Management receives regular updates on cybersecurity risks from the DITSC. In the event of a security incident, the DITSC will follow the escalation process in our incident response plan to notify the Company's Crisis Committee, which is composed of a cross-functional group of Company leaders. The Crisis Committee will work with the DITSC to respond to and remediate any actual cybersecurity incidents. Depending on the severity of the security incident, the DITSC and the Crisis Committee are to escalate the security incident to the Company's General Counsel and the Principal Accounting Officer, who will assess materiality in consultation with outside counsel. The General Counsel will notify the Technology Committee and the Board of any potential material incident.

companyName: Designer Brands Inc.

ticker: DBI


text: The CISO reports directly to Tyler's Chief Operations Officer ("COO"), who in turn reports to the President & Chief Executive Officer. Tyler believes this organizational structure provides a holistic and collaborative approach to cybersecurity risk management, as the COO also oversees Tyler's information technology, technology, and cloud operations teams, with whom the CISO works regularly and closely. The CISO also has a dotted line to the Chair of the Audit Committee.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: We conduct periodic assessment and testing of our policies, standards, processes, and practices including audits by independent third-party specialists in a manner intended to address cybersecurity threats and events. Policies are reviewed and revised on a frequent basis for relevance and to maintain compliance. The results of such assessments, audits, and reviews are evaluated by management and reported to the Audit Committee, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: Xencor Inc

ticker: XNCR


text: The Company's cybersecurity risk management processes are a component of the Company's overall risk management program. The Company's Board of Directors, directly and through its committees, is responsible for overseeing cybersecurity risks that affect the Company. As such, the Board has delegated oversight of risks related to cybersecurity to the Audit Review Committee of the Board of Directors (the "ARC"). The ARC is charged with reviewing the Company's cybersecurity risks, controls and procedures. The ARC reviews the Company's plans to mitigate cybersecurity risks and the Company's ability to respond to and remediate cybersecurity incidents. The ARC is informed of such risks through regular reviews with management regarding any specific cybersecurity issues that could affect the adequacy of internal controls over financial reporting.

companyName: HYSTER-YALE, INC.

ticker: HY


text: We expect that cybersecurity will become an important part of our risk management processes and an area of focus for our Board of Directors and management. We expect that our Board of Directors will be responsible for the oversight of risks from cybersecurity threats. We expect our senior management will provide our Board of Directors updates on at least an annual basis regarding matters of cybersecurity. This is expected to include existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. We expect that our Board members will also engage in periodic conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: Chilean Cobalt Corp.

ticker: COBA


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing and/or implementing new products, services and technology. We leverage people, processes and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detection tools designed to monitor, block and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems and network architecture, using internal cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: Blue Foundry Bancorp

ticker: BLFY


text: The Partnership faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Partnership has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Partnership's business, financial condition, results of operations, or cash flows. See "Risk Factors – Risks Related to the Partnership and Plan of Liquidation – Breaches in our data security systems or in systems used by our vendor partners, including cyber-attacks or unauthorized data distribution by employees or affiliated vendors, or disruptions to access and connectivity of our information systems could impact our operations or result in the loss or misuse of customers' proprietary information" for more information about the cybersecurity risks the Partnership faces.

companyName: GPB Holdings II, LP


text: The monitoring and surveillance procedures over our key systems and IT environments are performed jointly with Genworth. Potential threats are evaluated, correlated and escalated to the extent appropriate. Incidents that are subject to escalation are initially evaluated by a team of IT security personnel led by our Chief Information Security Officer. If the incident is sufficiently severe, it will trigger our cybersecurity incident response plan, which is carried out by a cross-functional team who ultimately report findings and suggest action plans to our senior leadership team and Genworth. In accordance with the plan, we assess, contain and eradicate the threat and notify relevant external parties. We engage with third parties to assist with the research and evaluation, if deemed necessary.

companyName: Enact Holdings, Inc.

ticker: ACT


text: Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to monitor such potential cybersecurity risk exposures, putting in place appropriate mitigation measures and maintaining the cybersecurity program. Our cybersecurity program for our information systems is directed by our CIO and, with the cybersecurity team, our CIO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CIO has a Bachelor of Science in Computer Engineering, a Master of Business Administration, and over 35 years of experience working in the information technology field, including approximately 20 years of CIO positions. Our CISO is CISSP-ISSMP and CISM certified and is part of a team of experienced information system security professionals with diverse certifications, including CISSP, CISM, CNSS, CEH, CySA+, CompTIA - Security+, CySA+, PenTest+, and CASP+ and others. Management, including the CIO and CISO, update the Audit Committee on a regular basis on our cybersecurity program, material cybersecurity risks, mitigation strategies, cybersecurity metrics, developments in cybersecurity and proposed updates to our cybersecurity program.

companyName: STERIS plc

ticker: STE


text: Our cybersecurity incident response plan is a key component of our cybersecurity program. The response plan is designed to report certain cybersecurity incidents to members of Cybersecurity Management, who then work with the Company's incident response team to help the Company control, mitigate and remediate cybersecurity incidents of which they are notified. In addition, the response plan includes prompt reporting to the board of directors (or audit committee) of certain cybersecurity incidents and of the company's materiality and disclosure determinations relating thereto.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: Although we take reasonable and effective measures to ensure the protection of any data that is stored, processed, or transmitted through our systems, we know that attackers have the means, motives, and opportunities to attack. As of the date of this filing we are not aware of any material risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. In addition, we maintain controls and procedures that are designed to ensure prompt escalation of critical cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner. Please refer to "Item 1A. Risk Factors" for further information about the material risks associated with various cybersecurity threats.

companyName: CSG SYSTEMS INTERNATIONAL INC

ticker: CSGS


text: Our Chief Operating Officer oversees our cybersecurity policies and processes, including those described in "Cybersecurity Risk Management and Strategy" above.

companyName: Merus N.V.


text: Our board of directors is responsible for the oversight of cybersecurity risk management. The Chief Financial Officer reports to the board of directors. The Chief Financial Officer provides updates to the board of directors on our cybersecurity risk management program, including any critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards on a regular basis. The Chief Financial Officer also notifies the board of directors of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.

companyName: Cingulate Inc.

ticker: CING


text: Management, provided by Ashford Inc. is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer of Ashford Inc. and the Chief Technology Officer for Remington Hospitality. A Cyber Incident Response Team comprised of Ashford Inc. and Remington Hospitality employees meets bi-weekly to review incidents that have occurred and/or impacted the Company's electronic assets. The Chief Technology Officer of Remington Hospitality reviews weekly reports that contain an overview of the activity in the department, any United States Computer Emergency Readiness Team alerts processed and all findings from the preventative maintenance tools. The Chief Technology Officer provides such report to the Chief Financial Officer on a quarterly basis. The Audit Committee of the board of directors is then briefed each quarter on the occurrence of any cybersecurity incidents. The board of directors will also be provided an overview of the information security program on an annual basis, including updates on Remington Hospitality's IT team, IT training, implementation, IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.

companyName: Stirling Hotels & Resorts, Inc.


text: As part of our enterprise risk management program, the Board of Directors (the "Board") meets with our senior management team, which includes our Chief Executive Officer, Chief Financial Officer, and General Counsel to address risks associated with cybersecurity threats on a regular basis. The Board receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been resolved.

companyName: Acreage Holdings, Inc.


text: While our board of directors is responsible for oversight and risk management in general, our Audit Committee provides oversight of our technology management strategy to ensure that cybersecurity threats and risks are identified, evaluated, and managed. The Audit Committee receives periodic updates from our management team regarding the overall state of our technology management strategy and any relevant risks from cybersecurity threats and cybersecurity incidents.

companyName: Checkpoint Therapeutics, Inc.


text: We have developed and implemented an information security and cybersecurity risk management program ("Program") intended to protect and preserve the confidentiality, integrity and availability of our data and information technology systems. Our Program is integrated into our overall enterprise risk management program. We use the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF") as a benchmark to ensure that our Program is maintained in line with industry best practices. This does not imply that we meet any particular technical standards, specifications or requirements, but it does mean that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: AMPHENOL CORP /DE/

ticker: APH


text: The Audit and Finance Committee reports to the Board regarding its activities, including those related to cybersecurity. The Board also receives a briefing from management on our cyber risk management program at least annually. Board members receive presentations on cybersecurity matters from our CISO and CIO, information security team or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Seagate Technology Holdings plc

ticker: STX


text: We also engage third party service providers when deemed necessary to both expand our capabilities and capacity as well as evaluate the effectiveness of our cybersecurity program, including hosting regular table-top exercises meant to evaluate and improve the overall effectiveness of our cybersecurity program.

companyName: APPLIED INDUSTRIAL TECHNOLOGIES INC

ticker: AIT


text: Our cybersecurity program includes a well-documented process for oversight of cybersecurity risks associated with our third-party service providers. We evaluate our third parties prior to any engagements. We also request System and Organization Controls reports from our third-party vendors to obtain reasonable assurance that their controls are present and functioning.

companyName: Green Plains Inc.

ticker: GPRE


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to provide that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs.

companyName: PAR TECHNOLOGY CORP

ticker: PAR


text: The oil and gas industry, including the mineral and royalty space, has become increasingly dependent on digital technologies to conduct certain activities. Sitio depends on digital technologies to perform many of its services and to process and record financial and operating data. Sitio therefore recognizes the importance of developing, implementing, and maintaining effective cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We seek to assess, identify and manage cybersecurity risks through the processes described below.

companyName: Sitio Royalties Corp.


text: The Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of enterprise level risks, including any cybersecurity-related risks faced by the Company. At least quarterly, the Audit Committee reviews cyber risks and mitigation strategies with senior management. The Audit Committee reports to the full Board regarding its activities, including those relating to cybersecurity. Additionally, on an annual basis, the Chief Technology Officer ("CTO") presents to the Audit Committee on any material updates to the cybersecurity program, such as process improvements, new initiatives and key vendor performance. Material cybersecurity events, if any, are escalated to the Board on an ongoing basis. The Board is also briefed annually on all major enterprise risks, including cybersecurity risks.

companyName: ESSEX PORTFOLIO LP


text: HCTI's technical officers have primary responsibility for the development and oversight of HCTI's cybersecurity team and the development and maintenance of the company's related cybersecurity policies and procedures. The team has several years' worth of experience working in the information and operational technology field and are registered professional engineers. The company's cybersecurity team continuously assesses the evolving cyber threat landscape based on their expertise and that of our third-party partners. They then work with all parts of HCTI to protect against, detect, identify, respond to, and recover from the risks that cybersecurity threats present. The cybersecurity team views and responds to cybersecurity risks in a holistic manner, applying a comprehensive multilayered strategy to prevent, detect, and mitigate them. They have identified HCTI's critical cyber assets and taken appropriate steps to protect them. External expertise is regularly engaged to assess HCTI's cybersecurity program and help the cybersecurity team to strengthen the organization's monitoring, alerting, prevention, mitigation, and recovery capabilities. Tabletop simulations, third party cyber vulnerability assessments, maturity assessments, and partnerships are used to assess and refine all elements of our cybersecurity program. In addition to managing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Risk assessments are performed against third-party service providers with a specific focus on any sensitive data that is to be shared with them. The internal business owners of HCTI's applications are required to document user access reviews regularly. We request a System and Organizational Controls (SOC) 2 report from the vendors of our enterprise cloud applications. If they do not provide us with a SOC 2, we seek additional compensating risk assurance in our contract language with them. Risks associated with the use of third-party service providers are managed as part of our overall cybersecurity risk management framework.

companyName: Healthcare Triangle, Inc.

ticker: HCTI


text: Our internal controls and procedures address cybersecurity and include processes intended to ensure that security breaches are reported to appropriate personnel and, if warranted, analyzed for potential disclosure. We also maintain insurance coverage that is intended to address certain aspects of cybersecurity risks. To date, there have not been any cybersecurity threats that have materially affected the Company.

companyName: Anixa Biosciences Inc

ticker: ANIX


text: While management is responsible for the day-to-day management of cybersecurity risks, our Board and Audit Committee have ongoing oversight roles. Our Audit Committee has responsibility for, among other things, oversight of our information technology and cybersecurity processes and procedures, including oversight of risks from cybersecurity threats. The Audit Committee reviews and discusses with management, including reports from our CIO, at least annually: • the adequacy and effectiveness of our information technology security processes and procedures, • the assessment of risks and threats to our information technology systems, • the internal controls regarding information technology security and cybersecurity, and • the steps management has taken to monitor and mitigate information technology security and cybersecurity risks.

companyName: FREEPORT-MCMORAN INC

ticker: FCX


text: Our information security team is also responsible for cybersecurity awareness and education across the company, including our Board of Directors. Awareness empowers users, including our employees and contractors, to be mindful of cybersecurity in day-to-day situations. Our cybersecurity education practices help ensure specific users have the appropriate security skills and competencies to help prevent and/or detect and respond to a cyber threat. Formal training is delivered and measured throughout our organization on a routine, ongoing basis, and dedicated training is delivered to all new employees and contractors through our onboarding process. Targeted and company-wide communications, as well as simulated phishing campaigns and tabletop exercises are also routinely executed to promote ongoing awareness, preparation and education about cyber threats.

companyName: Elanco Animal Health Inc

ticker: ELAN


text: Our CIO has over 20 years of experience building, developing, and leading high-performance cloud, IT, and security teams globally—while strategically aligning IT and security services for organizational success. Prior to joining Instructure in 2021, he was SVP of Cloud Customer Operations and the Chief Information Security Officer at a business intelligence and analytics firm. Before that, he led global IT and information security for the largest dedicated global software security firm. He has a Master's Degree in Information Systems from George Mason University and a Bachelor's Degree in Computer Science from SUNY Buffalo.

companyName: INSTRUCTURE HOLDINGS, INC.


text: Our Computer Security Incident Response Team ("CSIRT") is responsible for coordinating and executing on the cybersecurity response procedures and for seeking assistance from other Company stakeholders and external advisors. Our CSIRT includes IT leadership, an Incident Commander, our Senior Vice President & Chief Financial Officer, Legal counsel, Human Resources, and Internal Audit. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team includes our Vice President of IT and CIO, who has over 20 years of experience in IT with direct experience overseeing our IT security team for the past two years.

companyName: ARCH RESOURCES, INC.


text: Our Vice President of IT remains informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Vice President of IT implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. The Company conducts an annual review of its cybersecurity measures and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: CHUY'S HOLDINGS, INC.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our company, including our business strategy, results of operations or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, may be reasonably likely to materially affect our operations and, therefore, our results of operations and/or financial condition. For more information about these risks, see Item 1A., "Risk Factors - Cyber incidents targeting our digital work environment or other technologies or energy infrastructure may adversely impact our operations."

companyName: EQT Corp

ticker: EQT


text: The Audit Committee receives annual reports from management on information security matters, including our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: iHeartMedia, Inc.

ticker: IHRT


text: Our cyber risk management program identifies, tracks, escalates, remediates, and reports cyber related risks throughout the Company. These risk areas include internal, product, vendor, supply chain, and external services utilized across the Company. These risks are assessed, prioritized, and both tactically and strategically addressed via process, technology, and personnel improvements to ensure ongoing mitigation and tracking. We utilize internal and external resources to monitor for cybersecurity threats to our systems and networks and to understand the broader threat environment.

companyName: Global Business Travel Group, Inc.

ticker: GBTG


text: The cybersecurity risk management program, processes and strategy described in this section are limited to the personal and business information belonging to or maintained by the Company (collectively, "Confidential Information"), our own third-party critical systems and services supporting or used by the Company (collectively, "Critical Systems"), and Service Providers. The Company's subsidiaries lease to and, in some instances, manage for our tenants the properties we own, but we do not have actual or contractual access to the systems or information maintained or used by our tenants. Our tenants are directly or indirectly (through their own service providers) responsible for maintaining programs and processes to protect their systems and information from various risks from cybersecurity threats.

companyName: Peakstone Realty Trust

ticker: PKST


text: Risk-based, layered controls – We regularly assess and adjust our technical controls and methods to identify, respond to and mitigate emerging cybersecurity risks and use a layered approach with overlapping controls to defend against cybersecurity attacks and threats to our networks, end-user devices, infrastructure, applications, data and cloud solutions and the data that our customers entrust to us.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.

companyName: CytomX Therapeutics, Inc.

ticker: CTMX


text: Our program is informed by industry standards, including the National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF), the American National Standards Institute encryption standards and the Payment Card Industry Data Security Standard. As part of our cybersecurity strategy, we regularly engage independent, outside expertise to assess and benchmark our overall program against these industry standards.

companyName: AUTOZONE INC

ticker: AZO


text: Risk management is a central part of our cybersecurity program. We conduct regular risk assessments and monitor our information systems for potential vulnerabilities. We employ a risk quantification model to identify, measure, and prioritize cybersecurity and technology risks, and we implement corresponding security controls and safeguards based on model outputs.

companyName: LOWES COMPANIES INC

ticker: LOW


text: We continually evaluate cybersecurity risks on an ongoing basis as part of our overall risk management strategy. We assess and identify cybersecurity risks through periodic risk assessments, penetration testing, and vulnerability scans, among other procedures and practices. We also receive cybersecurity alerts and threat intelligence from our peers, government agencies, information sharing and analysis centers and cybersecurity-related groups or associations. These and other measures are used to evaluate cybersecurity risks in a timely manner and to allocate resources in alignment with the overall risk management program. In the event of an incident, we intend to follow our detailed incident response policy, which outlines the steps to be followed from incident detection to eradication, recovery and notification. In addition, we regularly engage various third-parties to assess or test our systems and processes to enhance our detection and management of cybersecurity risks or assist with implementation of our risk management strategies, including consultants who assist with assessing risks and information security experts who conduct tabletop exercises with participation from company management.

companyName: Installed Building Products, Inc.

ticker: IBP


text: Risk Management and Strategy Overall Risk Management. We have implemented a cyber risk management program to help ensure that our electronic information and information systems are protected from various threats and are built on and follow the Cybersecurity Maturity Model Certification for information security requirements and the protection of sensitive information. The cyber risk management program is maintained as part of our overall governance, enterprise risk management program and compliance program. Our information systems experience ongoing and often sophisticated cyberattacks by a variety of sources with the apparent aim to breach our cyber-defenses. We also have cyber event related insurance. We are continuously reevaluating the need to upgrade and/or replace systems and network infrastructure. These upgrades and/or replacements could adversely impact operations by imposing increased expenses, creating delays or outages, or experiencing difficulties transitioning to new systems. System disruptions, if not anticipated and appropriately mitigated, could adversely affect our company. We continually assess risks from cybersecurity threats and adapt and enhance our controls accordingly.

companyName: Knife River Corp

ticker: KNF


text: Our management takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: Arcutis Biotherapeutics, Inc.

ticker: ARQT


text: an information technology team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO


text: We implement and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, products and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature (collectively, Information Systems and Data).

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: While we have not, as of the date of this Report, experienced any material cybersecurity incidents that materially affected us, including our operations, business strategy, results of operations, or financial condition, we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our business, financial condition, results of operations. See "Risk Factors – We are exposed to cybersecurity threats or incidents."

companyName: AEHR TEST SYSTEMS

ticker: AEHR


text: To date there have been no cybersecurity incidents that have materially affected the Company or its operations. Despite security measures we have implemented, there is always the risk that certain cybersecurity incidents could materially disrupt operational systems limiting our ability to manufacture and deliver products to customers.

companyName: Arq, Inc.

ticker: ARQ


text: Incident Response and Testing. We have a robust cybersecurity incident response plan that incorporates regular simulations, drills, and vulnerability scans, penetration testing and third-party assessments of our cybersecurity controls and resilience.

companyName: Ingevity Corp

ticker: NGVT


text: ITW's Board of Directors is responsible for providing oversight and strategic guidance to management to support the long-term interests of the Company's stakeholders. As part of this responsibility, the Board of Directors annually reviews and evaluates the Company's cybersecurity policies and practices with respect to risk management as well as steps taken by management to monitor and control such exposures. In addition to oversight by the Board of Directors, several cross-functional management teams focus on cybersecurity risk and report any identified cybersecurity incidents. Each of the Company's divisions has a Division Cyber Incident Response Team and protocols in place to communicate cybersecurity incidents to a central Cyber Incident Response Team. The Cyber Incident Response Team is led by the Chief Information Security Officer ("CISO") and is responsible for the initial assessment of cybersecurity incidents and oversight of any incident response.

companyName: ILLINOIS TOOL WORKS INC

ticker: ITW


text: The Bank's board of directors devotes significant time and attention to data and systems protection, including cybersecurity and information security risk. The board of directors Enterprise Risk and Operations Committee (EROC) oversees the Bank's information security program through setting of policies and the Bank's risk management framework and has oversight of the cybersecurity risk management efforts which include risks from cybersecurity threats and has assigned specific controls for the mitigation, monitoring and reporting associated with those risks. The board also oversees management's approach to staffing, and processes and practices to gauge and address cybersecurity and information security risk. The board receives reports on management of cybersecurity risk and implementation of cybersecurity risk management as well as presentations and reports on cybersecurity effectiveness assessments and monitoring updates, along with management's recommendations regarding Bank's information security policies.

companyName: Federal Home Loan Bank of Atlanta


text: Material Cybersecurity Risks, Threats & Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. Additionally, we also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continued improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, stakeholder effects, revenue loss, legal actions, statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Report under the heading "Risks Related to the Business," which should be read in conjunction with the foregoing information.

companyName: SILVERBOW RESOURCES, INC.


text: 5. Material Cybersecurity Incidents During the reporting period, the Company experienced a cybersecurity incident related to employee interactions with suspicious websites. The incident was promptly contained, and a forensic investigation confirmed that no material impact occurred to operations, financial position, or customer data.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect FHLBank, including FHLBank's business strategy, results of operations or financial condition.

companyName: Federal Home Loan Bank of Topeka


text: To better understand Viasat's threat landscape we partner with multiple U.S. government agencies to acquire and share cybersecurity threat intelligence related to threats, vulnerabilities, indicators of compromise, and current, relevant threat information that are expected as a cleared defense contractor and active Defense Industrial Base (DIB) member. Partner entities include the Defense Cyber Crime Center (DC3), Defense Cybersecurity Information Sharing Environment (DCISE), DCMA, National Security Agency Cybersecurity Collaboration Center (NSA CCC), and Defense Counterintelligence and Security Agency (DCSA). Viasat is also an active participant in several Information Sharing and Analysis Centers, including the National Defense (ND-ISAC), Aviation (A-ISAC), and Space (Space ISAC) ISACs.

companyName: VIASAT INC

ticker: VSAT


text: While the Company faces a number of cybersecurity risks in connection with its business, as of the date of this report, the Company is no t aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, there can be no assurance that the Company, or its third-party service providers, will not experience a cybersecurity threat or incident in the future that could materially adversely affect the Company, including its business strategy, results of operations, or financial condition. For further discussion of the risks related to cybersecurity, see the risk factors discussed under Item 1A. "Risk Factors" in this report.

companyName: TILE SHOP HOLDINGS, INC.

ticker: TTSH


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, patient data, and data related to our clinical trials ("Information Systems and Data").

companyName: Minerva Neurosciences, Inc.

ticker: NERV


text: Our Executive Vice President, Technology Operations and our Executive Vice President, Software Development & IT collectively oversee our cybersecurity program. Our Executive Vice President, Technology Operations is responsible for operating our customer product technology infrastructure across our 41-state footprint. He has served in various network operations roles at Charter since 2016 and previously held various engineering roles at other large public companies. Our Executive Vice President, Software Development & IT leads software development, security, technical integration, and IT. He has served in various software and engineering roles at Charter since 2016, and has previously held various IT roles, including chief information officer, at other telecommunications companies.

companyName: CHARTER COMMUNICATIONS, INC. /MO/

ticker: CHTR


text: We are an externally managed company and our day-to-day operations are managed by our Manager and our officers under the oversight of our board of directors. We are reliant on our Manger, identifying, assessing and managing material risks to our business from cybersecurity threats.

companyName: Rithm Property Trust Inc.

ticker: RPT


text: We provide regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes, and practices.

companyName: SEELOS THERAPEUTICS, INC.


text: We encourage proactive vulnerability reporting through our vulnerability disclosure program, maintain appropriate incident response plans and procedures, and operate incident response teams capable of responding to cybersecurity incidents.

companyName: Canoo Inc.

ticker: GOEVQ


text: As part of the above processes, we may engage with assessors, consultants, auditors, and other third-parties, including by having a third-party review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.

companyName: LISATA THERAPEUTICS, INC.

ticker: LSTA


text: We have developed an information security program to assess, identify and manage material risks from cybersecurity threats. Our program includes policies and procedures that identify how security measures and controls are developed, implemented and maintained. We have aligned our cybersecurity program to the NIST Cybersecurity Framework and we assess our program against this standard annually. We are regulated by the Transportation Security Administration (TSA) as a pipeline infrastructure company and are required to comply with all TSA cybersecurity regulations. We use industry standard metrics to assess the criticality of software, data assets and operational technology.

companyName: NuStar Energy L.P.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our internal computer systems, or those of our collaborators or other contractors or consultants, may fail or suffer cybersecurity incidents, which could result in a material disruption of our product development programs," which disclosures are incorporated by reference herein. In the last three fiscal years, we have not experienced any material cybersecurity incidents.

companyName: SYNLOGIC, INC.

ticker: SYBX


text: We also use third-party service providers to perform a variety of functions throughout our business, such as software-as-a-service providers, hosting companies, supply chain resources, contract research organizations, and contract manufacturing organizations. Depending on the nature of the services provided, the sensitivity of the critical systems, information and assets at issue, and the identity of the provider, we may conduct a review of security assessments provided by the vendor and impose contractual obligations related to cybersecurity on the vendor.

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, and financial condition are regularly evaluated. TIAA maintained appropriate cyber security policies and procedures during the 12-month period covered by this report and there were no material cybersecurity issues that affected us. Cybersecurity risk remains heightened to the financial industry, including us, and a failure in or breach of our systems or infrastructure, or those of a material third party or service provider, could cause disruption and adversely impact our operations. TIAA continues to invest in the cybersecurity program to protect against emerging threats, including threats against third parties and service providers.

companyName: Nuveen Global Cities REIT, Inc.


text: As of the date hereof, the Company has not encountered cybersecurity incidents that the company believes to have been material to the Company taken as a whole.

companyName: EvoAir Holdings Inc.

ticker: EVOH


text: We face rapidly evolving and sophisticated threats of breaches of our systems and networks as well as those of our suppliers and third-party service providers. To mitigate this threat to our business, we take a comprehensive approach to cybersecurity and expend considerable resources on cybersecurity risk management, strategy, and governance.

companyName: Elastic N.V.

ticker: ESTC


text: The audit committee and our risk committee, a management committee overseeing our enterprise risk management program, receive periodic reports from our CISO regarding key cybersecurity risks facing the company, our cyber risk management program, significant cybersecurity incidents involving us or our third-party service providers, and the progress of ongoing initiatives as well as the effectiveness of internal control and compliance mechanisms. The audit committee, in turn, briefs our board of directors on its cybersecurity oversight activities as appropriate or necessary.

companyName: Maplebear Inc.

ticker: CART


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including our Senior Director of Information Technology, who has over 23-years of experience in IT management (including cybersecurity) and a degree in Computer Information Systems.

companyName: Clearside Biomedical, Inc.

ticker: CLSDQ


text: Our Chief Technology and Product Officer supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, and alerts and reports produced by security tools deployed in the IT environment, such as regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises.

companyName: Opendoor Technologies Inc.

ticker: OPEN


text: In addition, the Board will oversee any cybersecurity risk management framework and a dedicated committee of the Board, or an officer appointed by the Board will review and approve any cybersecurity policies, strategies and risk management practices.

companyName: Nature's Miracle Holding Inc.

ticker: NMHI


text: We maintain plans to address any cybersecurity incidents, including but not limited to Crisis Management Policies and Procedures, an Incident Response Plan, an Information Security Incident Management Policy and a Business Resiliency/Continuity Management Policy. Information security continuity is embedded in our business continuity management system to minimize the risk that continuity operations could result in a compromise to our security standards. We conduct business continuity, crisis communications and disaster recovery exercises at least annually to test and modify the plan, as needed. The activities related to the business continuity management system are routinely reported to executive management as part of our IT security team's ongoing metrics reporting. In addition, reports related to activities and outcomes are provided to the audit committee on a quarterly basis.

companyName: Paycom Software, Inc.

ticker: PAYC


text: Senior executives, including the Company's CEO and CFO, integrate cybersecurity risks into the overall business strategy and financial planning. The VP and IT security team provide regular reports to senior management on the Company's identified vulnerabilities, progress on cybersecurity initiatives and remediation efforts, and details of ongoing incidents. Management notifies the board of directors when significant incidents occur and provides the Audit Committee with quarterly updates on the Company's cybersecurity practices.

companyName: HOOKER FURNISHINGS Corp

ticker: HOFT


text: We have implemented a number of security measures designed to protect its systems and data, including firewalls, antivirus and malware detection tools, patches, log monitors, routine back-ups, system audits, system hardening, penetration testing and privileged access session management. In addition, we have continued its efforts to migrate its platforms to cloud-based computing, which is designed to further strengthen its security posture.

companyName: Webstar Technology Group Inc.

ticker: WBSR


text: Our cybersecurity program includes, but is not limited to: • annual cybersecurity education for all company computer users on relevant policies and standards, best practices at work and at home; • communication processes including how to identify, respond, and report threats or potential vulnerabilities; • protective software installed and configured on Company systems and mobile devices, updated and patched on a regular basis, to provide the highest level of protection against malicious threats; • an established program based on the MITRE ATT&CK framework for dealing with ransomware and other cybersecurity incidents; • regular technical risk assessments of our network, applications and manufacturing facilities, using a combination of trusted suppliers and a dedicated, objective team; • penetration, discovery and vulnerability assessments conducted daily; • mobile threat protection mechanisms and policies; • business continuity plans that are well documented and tested regularly; disaster recovery plans that are also well documented and tested at least annually; certain key financial applications that are tested at least semi-annually; and • coverage for non-damage business interruption or liability for data breaches as a part of the Company's combined insurance programs. In addition, in 2024, management conducted ransomware simulation exercises and engaged outside consultants to perform external perimeter penetration testing.

companyName: LyondellBasell Industries N.V.

ticker: LYB


text: In designing our Information Security Program, we refer to established industry frameworks – in particular, the Federal Financial Institutions Examination Council (FFIEC) and guidance from the International Organization for Standardization (ISO). The FFIEC framework offers a set of guidelines to help financial institutions effectively manage and mitigate cybersecurity risks. ISO/IEC 27001 is an international standard developed by the ISO specifically for Information Security, Cybersecurity and Privacy Protection (ISCPP). These frameworks provide best practices for managing cybersecurity risks and ensuring information security, and we consider them to be aspirational benchmarks to help inform the design of our Information Security Program. While our program is designed to be robust, the sophistication and evolving nature of cyber threats mean no system can fully eliminate risk. For more information on how cybersecurity risk may affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A, Risk Factors — Risks Related to Cybersecurity, Data and Fraud.

companyName: BANNER CORP

ticker: BANR


text: The Company continuously seeks to identify threats, vulnerabilities, and cybersecurity risks on information assets. Threats are identified through experience, regulatory requirements, information sharing, third party vendors, internal and external security assessments, and industry periodicals.

companyName: BANCFIRST CORP /OK/

ticker: BANF


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the chief information officer, Jovan Kangrga. Mr. Kangrga has managed cybersecurity and information security at Array for the past five years and has over 14 years of total experience as an information technology executive for publicly listed companies. Mr. Kangrga holds B.S. degrees in finance and computer science from Arizona State University as well as a M.B.A. from Western International University. He manages a team with over 40 years of combined experience in cybersecurity. Our chief information officer reports to our chief financial officer, and both our are responsible for updating the chief executive officer, the Nominating & Corporate Governance Committee, and our board of directors on cybersecurity issues.

companyName: Array Technologies, Inc.

ticker: ARRY


text: Supplier Risk Management and Strategy Within the governance, risk and compliance division of our Information Security team, we operate a formal supplier security assessment program, with a team dedicated to evaluating the cybersecurity risk associated with third-party suppliers with whom we have contracted and who we believe may pose a cybersecurity threat to the Company, our customers or our business partners due to the type of services they provide and/or confidential information they may be handling. This team assesses the security posture of the supplier, as well as the security of the systems and services provided. In addition, the team works closely with our procurement and legal teams to help ensure that appropriate security requirements are included in our contractual arrangements with the suppliers. The team conducts an assessment both at the outset of the engagement of a new supplier, and then periodically thereafter, based on assigned risk levels, as well as in the event of any new services or changes to the engagement. The Information Security team's process for conducting periodic security reviews of third parties is a component of our operational risk management team's broader periodic review of third parties.

companyName: LINCOLN NATIONAL CORP

ticker: LNC


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any significant cybersecurity incidents.

companyName: ADVANCED MICRO DEVICES INC

ticker: AMD


text: We devote significant resources and efforts to protecting the security of our information technology and operational systems, including utilizing threat monitoring and commissioning assessments by third parties, taking guidance from ISO information security standards, and conducting proactive risk and compliance reviews against regulatory, industry, and evolving data privacy requirements. We provide ongoing cybersecurity training to our employees based on access to our network and roles, which includes annual training to non-factory employees on our acceptable use policy, our data protection methods, and social engineering tactics used by threat actors. We maintain a cross-functional cybersecurity incident management procedure with defined roles, responsibilities, and reporting protocols that is designed to timely respond to, investigate, mitigate, remediate, and if appropriate, disclose, a cybersecurity incident. Furthermore, we practice our response to potential cybersecurity incidents through tabletop exercises.

companyName: SKYWORKS SOLUTIONS, INC.

ticker: SWKS


text: To help oversee and identify risks from cybersecurity threats associated with the Company's use of third-party service providers, the Company has a third-party information risk management program intended to minimize the likelihood of misuse of Choice data by third parties and business partners and requires that third-party service providers complete a periodic security risk assessment. Depending upon the identified risk, actions such as obligating the third party to remediate the identified deficiencies or termination of the relationship may occur. Also, depending upon the nature of the relationship and data, third party agreements include security and privacy provisions that oblige third parties to abide with applicable regulations and employ reasonable security controls.

companyName: CHOICE HOTELS INTERNATIONAL INC /DE

ticker: CHH


text: The Company's Vice President of Information Technology, Security and Business Intelligence, in coordination with senior leadership, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's policy as it relates to the incident, management response and recovery plan. Through the ongoing communications from these teams, the Vice President of Information Technology, Security and Business Intelligence and senior leadership monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.

companyName: Axogen, Inc.

ticker: AXGN


text: Management's Assessment and Management of Cybersecurity Threats Our multi-level cybersecurity governance and risk management structure begins with our Operational Risk Compliance and Security ("ORCAS") Committee consisting of cross-functional management representatives throughout our Company. The ORCAS Committee receives detailed cybersecurity information from key security personnel and reports at least quarterly up through our Risk Steering Committee, which is made up of executives and senior management from various Blackbaud departments: Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, Chief Technology Officer, General Counsel, Chief Privacy Officer and CISO, who has extensive information technology and program management experience. Our CISO has served in various roles of increasing responsibility in information technology and information security for more than 25 years, including serving in various cybersecurity leadership roles within public and private companies. He holds two undergraduate degrees—one in business administration and the other in computer information systems, a graduate degree in information systems and maintains two cybersecurity industry recognized certifications: Certified Information Systems Security Professional (CISSP) and Certified Cloud Security Professional (CCSP), both from the International Information System Security Certification Consortium. Cybersecurity leaders reporting to our CISO also have significant information technology and information security experience and industry recognized certifications.

companyName: BLACKBAUD INC

ticker: BLKB


text: To mitigate risk to its systems, endpoints and data, the Company evaluates internal and external threat intelligence, deploys encryption and authentication technologies and other protective measures, maintains security policies and procedures, and conducts vulnerability testing and awareness training. The Company also conducts penetration testing and other risk assessments, implements appropriate internal controls, and engages independent third-party auditors to evaluate its compliance with security compliance standards.

companyName: BLACKBERRY Ltd

ticker: BB


text: The Company's VP, IT Security and Risk Management and interim CIO, who collectively lead our Cybersecurity and Risk Management Team, have relevant degrees and certifications in Information Technology and Security and have extensive experience in their current and prior roles related to IT Security. Along with leading the Company's cybersecurity learning and awareness trainings, they also regularly participate in various third-party industry conferences and trainings.

companyName: Bausch & Lomb Corp

ticker: BLCO


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • an internal team responsible for, inter alia, managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers with subject matter expertise, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management evaluation process for service providers, suppliers, and vendors with access to our information systems or data.

companyName: Phathom Pharmaceuticals, Inc.

ticker: PHAT


text: In the ordinary course of our business, we, and the third parties upon which we rely, collect, process, receive, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, share and store (collectively, "process") proprietary, confidential, and sensitive information, including protected health information, personal information, credit card and other financial information, or other sensitive information owned or controlled by ourselves or our customers, payors, and other parties.

companyName: Celcuity Inc.

ticker: CELC


text: In the last fifteen fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.

companyName: ALPHA PRO TECH LTD

ticker: APT


text: The Board of Directors maintains the ultimate responsibility for oversight of the Company's risks, including cybersecurity risks. The Board regularly receives presentations on matters of cybersecurity risk from management. Management discusses matters of particular importance or concern as they may be materially impacted by risk on an ongoing basis, and members of the Company's Executive Committee ("EXCO") are also available to members of the Board for discussion and review both during meetings of the Board of Directors and at other times.

companyName: 1st FRANKLIN FINANCIAL CORP


text: Our cybersecurity program is managed by our executive management team, including our Chief Executive Officer and Chief Technology Officer, and includes mechanisms, controls, technologies, systems, policies, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the systems and data residing in them. We consult with outside advisors and experts to assist us with assessing, identifying, and managing cybersecurity risks.

companyName: CLOUDASTRUCTURE, INC.

ticker: CSAI


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer Committee (ISOC) is primarily responsible for this cybersecurity component. The ISOC is chaired by the Company's Chief Financial Officer with oversight by a third-party information security specialist. In addition, the ISOC members include our Chief Information Officer along with external technology and internal business resources. The ISOC makes quarterly reports to the board of directors.

companyName: TC Bancshares, Inc.

ticker: TCBC