text: Our Privacy program is designed to support and enhance our Cybersecurity program. We perform an annual HIPAA Security Risk Assessment, among other things, to help identify remediation priorities and to ensure we have implemented best practices in storing and safeguarding PHI.

companyName: Tempus AI, Inc.

ticker: TEM


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: DIH HOLDING US, INC.

secItem: Item 1C


text: The Company has a Security Incident Response Framework (Framework) in place. The Framework is a set of coordinated procedures and tasks that the Company's Incident Response team, under the direction of the CISO, executes with the goal of ensuring timely and effective resolution of cybersecurity incidents. To maintain the robustness of the Framework, from time-to-time the Company conducts cybersecurity tabletop testing exercises.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: The Company has engaged a third-party managed detection and response company to monitor the security of its information systems. The Company also maintains a cybersecurity insurance policy and has engaged a third-party incident response consultant and legal counsel.

companyName: GMS Inc.


text: Cyber Risk Management and Strategy Our cyber risk management and strategy has been incorporated into our compliance and risk management program across a number of verticals. For example, information security risk assessments are performed across our business processes, including, but not limited to, third-party services, vendors and systems that process sensitive data. We undergo external annual penetration assessments to evaluate susceptibility to attack, for example, through social engineering, application websites and system/network vulnerabilities. We aim to continuously evolve our information security program in response to the ever-changing landscape of best practices, industry-specific risks, company-specific risks, and potential threats. This evolution is also driven by validation tests in an effort to ensure our program remains robust and effective. In the wake of the October 2023 cybersecurity incident, we prioritized implementation of enhanced safeguards consistent with our incident response process and further fortifying our commitment to information security.

companyName: Maverick Merger Sub 2, LLC

ticker: COOP


text: Further, we have processes in place to evaluate potential risks from cybersecurity threats associated with our use of third-party service providers that will have access to Company data, including a review process for such providers' cybersecurity practices, risk assessments, continue to evaluate and enhance our systems, controls, and processes where possible, including in response to actual or perceived threats specific to us or experienced by other companies.

companyName: GIFTIFY, INC.

ticker: GIFT


text: In order to oversee and identify risks from cybersecurity threats associated our use of third-party service providers, we maintain a risk management program designed to help protect against the misuse of information technology. In addition to risk assessments and questionnaires obtained upon selection of a new service provider, we also perform annual third-party risk assessments to ensure these service providers continue to meet contractual obligations for cybersecurity, regulatory and industry requirements.

companyName: CORPAY, INC.

ticker: CPAY


text: Material Cybersecurity Risk, Threats & Incidents Routinely, we partner with and use third-party service providers and products that host, manage, or control sensitive data. We and the companies we work with have experienced cybersecurity threats to our data and systems, including ransomware and other forms of malware and computer virus attacks, unauthorized access, systems failures and temporary disruptions. For example, in June 2018, we identified forged and fraudulently induced electronic payment disbursements we made to third-parties in an aggregate amount of $10 million resulting from unauthorized third-party access to our email system. Risks from cybersecurity threats, including as a result of such previous incident, have not materially affected us, including our business strategy, results of operations or financial condition for the periods covered by this Annual Report, and we do not believe that such risks are reasonably likely to have such an effect over the long term. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Annual Report under the heading "Failure to maintain the integrity of internal or customer data or to protect our information systems from cyber-attacks could disrupt our business, damage our reputation, and subject us to costs, fines or lawsuits," which should be read in conjunction with the foregoing information.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: The CIRT consists of various IT groups with the knowledge and expertise needed to execute the technical aspect of the Company's cybersecurity policies and procedures, including our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"). As further described below, these officers are responsible for facilitating communications with the Risk Committee.

companyName: FIRST INTERSTATE BANCSYSTEM INC

ticker: FIBK


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Hudson Pacific Properties, Inc.

ticker: HPP


text: Furthermore, we perform regular third-party security penetration testing and cyber tabletop exercises with key stakeholders to simulate responding to a hypothetical cybersecurity incident.

companyName: MAXLINEAR, INC

ticker: MXL


text: Given the importance of cybersecurity to our business, we maintain a comprehensive information security program for assessing, identifying, managing and reporting on material risks from threats to our information security. Our information security program is based on industry standards and best practices, following the National Institute of Standards and Technology (NIST) Cybersecurity Framework. As part of our information security program, we also require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. We also train employees on how to identify potential cybersecurity risks and protect our information and resources. This training is mandatory for all employees globally upon hire and on an annual basis.

companyName: Enstar Group LTD


text: The GLB Act's Safeguards Rule requires financial institutions to: (i) appoint a qualified individual to oversee and implement their information security programs; (ii) implement additional criteria for information security risk assessments; (iii) implement safeguards identified by assessments, including access controls, data inventory, data disposal, change management, and monitoring, among other things; (iv) implement information system monitoring in the form of either "continuous monitoring" or "periodic penetration testing;" (v) implement additional controls including training for security personnel, periodic assessment of service providers, written incident response plans, and periodic reports from the qualified individual to the board of directors. Additionally, multiple states and Congress are considering laws or regulations which could create new individual privacy rights and impose increased obligations on companies handling personal data.

companyName: UNITED COMMUNITY BANKS INC

ticker: UCB


text: We also utilize external partnerships to help protect the Company from cybersecurity threats. This combination of people, processes and technology assist us to proactively manage and mitigate threats to our information technology environment. We have controls in place to defend against risks associated with cyber-attacks impacting our operations, compliance and financial reporting objectives. We are externally audited and certified under the ISO 27001 and assessed according to National Institute of Standards and Technology ("NIST") guidelines. Our external partners also evaluate our cybersecurity maturity and coverage as part of their services and keep us informed of emerging global threats.

companyName: BeOne Medicines Ltd.

ticker: ONC


text: The Company conducts periodic assessment and testing of the Company's policies, standards, processes, and practices including audits by independent third party specialists in a manner intended to address cybersecurity threats and events. Policies are reviewed and revised on a frequent basis for relevance and to maintain compliance. The results of such assessments, audits, and reviews are evaluated by management and reported to the Audit Committee, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: Xencor Inc

ticker: XNCR


text: We also maintain an incident response plan designed to coordinate the activities we take with a goal to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: In light of the complexity and evolving nature of the cybersecurity landscape, the Bancorp periodically re-assesses the maturity of its cybersecurity programs, policies and procedures, including in some instances by engaging the assistance of external experts. The Bancorp also conducts exercises to test its incident response plans and threat assessments, some of which also involve assistance from external consultants.

companyName: FIFTH THIRD BANCORP

ticker: FITB


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Corporate Governance and Oversight," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with and receives reports from the Company's ERM function, the Vice President of IT and Digital, the Company's Chief Information Security Officer ("CISO"), and other members of management. • Collaborative Approach: The Company has integrated cybersecurity risk management into its broader risk management framework to promote a Company-wide culture of cybersecurity risk management. To that end, the Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. The Company conducts security assessments of all of its electronic information-related third-party service providers before the Company engages them, and the Company maintains policies and procedures to oversee and identify cybersecurity risks associated with its use of third-party service providers. • Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: Vishay Precision Group, Inc.

ticker: VPG


text: We recognize the increasing volume and sophistication of cyber threats and take our responsibility to protect the information and systems under our purview seriously. Our cybersecurity processes aim to provide a comprehensive approach to assess, identify, and manage material risks arising from these cybersecurity threats.

companyName: TRANSCONTINENTAL GAS PIPE LINE COMPANY, LLC


text: Key elements of our risk management program relating to cybersecurity include: implementing risk assessments designed to help identify material risks, including risks arising from cybersecurity threats to our critical systems and information; engaging external cybersecurity consultants to assess and assist with aspects of our security processes; and maintaining insurance coverage related to cybersecurity matters. Currently, our management team's experience includes over 50 years combined experience in leadership roles at public companies. We are investing in additional resourcing and cybersecurity measures as we grow.

companyName: Tamboran Resources Corp

ticker: TBN


text: The Board of Directors are acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Audit Committee of the Board has the primary responsibility to oversee effective governance in managing risks associated with cybersecurity threats. Our Audit Committee is composed of members with diverse expertise, including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: MediaAlpha, Inc.

ticker: MAX


text: Our corporate information security organization, led by our CISO, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our current CISO has extensive information technology and program management experience and has served many years in our corporate information security organization. In addition, our CISO has a certificate in Cybersecurity Oversight from the Carnegie Mellon University Software Engineering Institute. The corporate information security organization oversees, manages, and continually enhances a robust enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur. Employees outside of our corporate information security organization also have a role in our cybersecurity defenses and they are immersed in a corporate culture that supports information security, which we believe improves our cybersecurity.

companyName: GEO GROUP INC

ticker: GEO


text: Our audit committee is responsible for the oversight of risks from cybersecurity threats and directly oversees our cybersecurity policies and practices, internal controls regarding information security, and compliance with legal and regulatory requirements regarding cybersecurity risks. The audit committee receives regular reports and updates on cybersecurity matters from the leaders of our dedicated security team and management, including developments on existing and new cybersecurity risks and how management is addressing and/or mitigating such risks, cybersecurity and data privacy incidents (if any), the status of key information security initiatives, vulnerability assessments, as well as on existing and emerging threat landscapes. Additionally, on at least an annual basis, the audit committee reviews and discusses with management our policies and programs with respect to the audit committee's oversight of cybersecurity threats, which enable the audit committee's effecting oversight of our overall cybersecurity risk and compliance posture. The audit committee regularly reports to the board of directors on these matters.

companyName: PIXELWORKS, INC

ticker: PXLW


text: Oversee requirements of the Bank's Vendor Management Policy, including processes for approving third -party providers including the financial condition, business resilience, and IT security position of third -parties. Ensure risk assessments and New Vendor Relationship Information is completed for all vendor relationships. Review and approve risk assessments for significant, critical vendor relationships on an annual basis. Examine the Bank's Business Continuity and Disaster Recovery Plan, including updates and testing. Provide for comprehensive, effective, and, if required, independent audit coverage of IT risks and controls.

companyName: Waterstone Financial, Inc.

ticker: WSBF


text: We use a third-party risk performance management program to evaluate cybersecurity risk for third-party service providers. Vendor cybersecurity controls are then assessed to determine if the vendor's control environment meets the Company's standards. Vendors are also assessed on a periodic ongoing basis according to their risk classification.

companyName: LPL Financial Holdings Inc.

ticker: LPLA


text: At the management level, our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, operations, legal and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of our and our customers' information by identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. Our Executive Security Committee, which includes our Chief Operating Officer, our CIO, our Chief Technology Officer, our Chief Development Officer, our General Counsel and other cross-functional participants, meets monthly to evaluate our cybersecurity risks and related response efforts.

companyName: Bandwidth Inc.

ticker: BAND


text: We rely on our information technology to operate our business. We have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: ADM TRONICS UNLIMITED, INC.

ticker: ADMT


text: The Audit Committee receives reports as part of its quarterly meetings from our CISO concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. Our board also receives periodic reports (at least annually) from our CISO regarding the overall cybersecurity landscape, including material related to cybersecurity threats, risk, and mitigation.

companyName: Freshworks Inc.

ticker: FRSH


text: In addition, our processes are designed to help identify, oversee, and mitigate cybersecurity risks associated with our use of third-party vendors. We have a third-party risk management process that includes evaluation of, and response to, cybersecurity risks at our third-party vendors, and this process covers vendor selection, onboarding, performance monitoring, and risk management. Our third-party risk management program includes policies and standards requiring that we perform cybersecurity due diligence reviews on our vendors based on the inherent risk profile of a particular supplier or service provider. We also monitor our principal third parties and service providers on an ongoing basis by conducting additional periodic reviews. Additionally, we execute agreements with our third-party vendors, independent contractor financial advisors, and firms affiliated with us through our RCS division under which these parties contractually agree to implement certain safeguards designed to protect firm data and mitigate cybersecurity risks.

companyName: RAYMOND JAMES FINANCIAL INC

ticker: RJF


text: Our business strategy, results of operations and financial condition have not been materially affected as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such cybersecurity risks or any future material incidents. For more information on our cybersecurity-related risks, see Item 1A, Risk Factors, elsewhere in this Annual Report on Form 10-K.

companyName: IRONWOOD PHARMACEUTICALS INC

ticker: IRWD


text: The Audit Committee and the full Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit Committee meets during the year and discusses cyber-related industry events, critical cyber incidents, alignment with our information security framework, threat assessment, security capabilities, response readiness and training efforts. The Audit Committee conducts an ongoing review of the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, planned actions in the event of a response or recovery situation, as well as a review of recent enhancements to the Company's security detection, prevention and response capabilities, and management's progress on its cybersecurity strategic roadmap. The Cybersecurity team also subscribes to various threat intelligence services to evaluate our security strategy or defense mechanism against such threats.

companyName: HASBRO, INC.

ticker: HAS


text: We have developed a cybersecurity incident response plan that provides a documented framework for handling cybersecurity incidents and facilitates coordination across multiple parts of the Company. Dedicated members of our information security team, led by our Senior Vice President, Information Technology and our Director of Information Security, continuously monitor threat intelligence feeds, handle vulnerability management and respond to incidents. In addition, we periodically perform simulations and drills at a technical level.

companyName: Construction Partners, Inc.

ticker: ROAD


text: In accordance with the Prospect Capital Management Information Technology Operations and Procedures, the cross-functional Change Advisory Board ("CAB") governs and oversees the advancement and implementation of policies and procedures to reasonably prevent security incidents. Prospect Capital Management's cybersecurity program also includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Prospect Capital Management's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and helping to identify areas for continued focus and improvement.

companyName: Prospect Floating Rate & Alternative Income Fund, Inc.


text: We use third -party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example threat intelligence service providers, cybersecurity consultants, cybersecurity software providers and penetration testing firm consultants.

companyName: PlayAGS, Inc.


text: We assess and identify security risks to the organization by: • Conducting regular risk assessments to determine the likelihood and magnitude of an attack from unauthorized access, use, disclosure, disruption, modification, or destruction of information systems and related information processes, stored, or transmitted; • Performing annual security assessments and producing security assessment reports for review by Information Technology ("IT") senior leadership, including the service center's Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"); • Regularly assessing security controls for effectiveness, proper functioning, and satisfactory results; and • Continuously monitoring and addressing vulnerabilities.

companyName: Pennant Group, Inc.

ticker: PNTG


text: The Company has a documented information security program (the Program) to identify, assess, monitor and manage potential cybersecurity threats and incidents. The Program is designed to protect the confidentiality, integrity and availability of our information systems and assets that store, process, or transmit information. The Program is modeled on the global standard for risk assessment, International Organization for Standardization 27001, and is guided by the six domains of cybersecurity established by the National Institute of Standards and Technology Cybersecurity Framework (i.e., govern, identify, protect, detect, respond, and recovery). The Program seeks to adhere to applicable U.S. and international laws and regulations, including New York State's cybersecurity regulation applicable to financial services institutions authorized by the New York State Department of Financial Services.

companyName: BERKLEY W R CORP

ticker: WRB


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We are subject to cybersecurity risks to operational systems, security systems, or infrastructure owned by Allison or third-party vendors or suppliers" in Part I, Item 1A. of this Annual Report on Form 10-K.

companyName: Allison Transmission Holdings Inc

ticker: ALSN


text: We have implemented a cybersecurity program in accordance with our risk profile and business size that is informed by recognized industry standards, including elements of the National Institute of Standards and Technology Cybersecurity Framework. We leverage the cybersecurity services of third-party vendors, including virtual chief information security officer services, to support out cybersecurity risk management program.

companyName: Metagenomi Therapeutics, Inc.

ticker: MGX


text: Cyber threats are considered one of the most significant risks facing financial institutions. Since our company is externally managed, we rely upon the operational and investment risk oversight functions of our Manager and its affiliates. To mitigate risk from cyber threats, our Manager has a designated Global Chief Security Officer ("GCSO") who leads the global security department that is responsible for identifying, assessing, and managing cybersecurity threats. The GCSO has experience in the public and private sectors, specializing in security, investigations, and incident response. The global security department oversees the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience and Corporate Security. This converged security structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees, and critical assets safe, upholding privacy rights, while enabling a secure and resilient business.

companyName: Invesco Mortgage Capital Inc.

ticker: IVR


text: We maintain a well-documented process to oversee cybersecurity risks associated with our third-party service providers. We evaluate our third parties prior to any engagements and review their System and Organization Controls reports to obtain reasonable assurance that their controls meet our security standards.

companyName: Green Plains Inc.

ticker: GPRE


text: Cybersecurity is an important area of focus for our Board of Directors. The Board of Directors reviews and discusses with our CIO the Company's cybersecurity, privacy and data security programs, the status of projects to strengthen internal cybersecurity, results from third-party assessments, any significant cybersecurity incidents, and the emerging threat landscape. Our CIO discusses the same cybersecurity topics covered with the Board of Directors with the IEB. In addition, the IEB makes decisions on resourcing and project prioritization in support of our cybersecurity and compliance initiatives.

companyName: Information Services Group Inc.

ticker: III


text: As part of our cybersecurity program, we conduct cybersecurity awareness training including phishing simulations and supplemental campaigns as well as mandatory e-learning for all our employees. Our employees have multiple mechanisms for reporting cybersecurity and data privacy concerns. We work with third-party cybersecurity advisors to undertake assessments of our critical systems and to remediate any high-risk vulnerabilities identified. We also engage third parties to perform penetration testing on our key systems to identify potential weaknesses.

companyName: lululemon athletica inc.

ticker: LULU


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor captioned "Significant disruptions of information technology systems or security breaches could adversely affect our business." Our board of directors addresses our cybersecurity risk management as part of its general oversight function.

companyName: MERRIMACK PHARMACEUTICALS INC


text: Our Senior Director, Information Technology (Senior Director, IT) is responsible for the strategic leadership and day-to-day management of our cybersecurity risk management program. The individual occupying this role has over thirty years of experience with information technology management and over five years of cybersecurity risk management.

companyName: Candel Therapeutics, Inc.

ticker: CADL


text: Given our current environment and structure of the Company, we outsourced a majority of our information technology functions in 2023, including but not limited to hosting and security access and cybersecurity generally, to third-party service providers. We relied primarily on third parties to assess, identify and manage material risks from cybersecurity threats. Our agreements with these third parties obligated these parties to provide us with various notifications and reports that help our management oversee and identify material risks from cybersecurity threats associated with our use of these third-party service providers.

companyName: Ampio Pharmaceuticals, Inc.

ticker: AMPE


text: Our CIO has more than 25 years of experience in information technology and reports to our Chief Financial Officer. Our Head of Information Security, who reports to the CIO, has over 20 years of experience managing global information technology and cybersecurity operations and holds multiple industry-recognized certifications such as Certified Information Systems Security Professional and Certificate of Cloud Security Knowledge.

companyName: SKYWORKS SOLUTIONS, INC.

ticker: SWKS


text: Our cybersecurity program aims to protect the uninterrupted availability of critical information technology resources. Regular assessments, conducted both internally and by third parties, evaluate our program against industry standards, including the National Institute of Standards and Technology Cybersecurity Standard and the Risk Management Framework.

companyName: MIDDLESEX WATER CO

ticker: MSEX


text: Management of Cybersecurity Matters At the management level, the Company's cybersecurity risk management activities are integrated into the day-to-day activities of the Company's information technology function led by our Chief Information Officer, who operates under the supervision of our Chief Financial Officer. The Company's information technology function has a dedicated cybersecurity team comprised of employees with, on average, nearly 20 years of experience and expertise in cybersecurity, and includes individuals with degrees in Computer Studies and cybersecurity-related certifications including Certified Information Systems Security Specialist (CISSP), Certified in Risk and Information Systems Controls (CRISC), and Certified Information Security Manager (CISM).

companyName: CVR ENERGY INC

ticker: CVI


text: Cybersecurity considerations affect the selection and oversight of the Company's third-party product and service providers. The Company performs due diligence on third parties that have access to its critical systems and data and whose products and services are integrated into the Company's products. Contractual undertakings and oversight are put in place, based on the results of the risk assessment to manage and reduce the cybersecurity risk associated with such third-party providers. Such undertakings may include requirements to comply with administrative, technical and physical safeguards to provide notification of cyber incidents involving the Company's systems or data and agreements to be subject to cybersecurity audits, which the Company conducts as appropriate. The Company requires compliance with appropriate certifications (e.g., SOC 2, ISO 27001, etc.) or appropriate alternative requirements, depending on the offering, region of use, and other factors.

companyName: Johnson Controls International plc

ticker: JCI


text: We operate a risk-based cybersecurity program dedicated to protecting the confidentiality, integrity and availability of our information systems and the information residing therein.

companyName: YETI Holdings, Inc.

ticker: YETI


text: Risk Assessment: Identified risks are assessed and ranked on at least an annual basis using a likelihood and impact assessment as part of EQT's enterprise risk framework. In addition, the security team has an information security risk management process in place, through which risks are continuously assessed, managed and reported upon.

companyName: EQT Exeter Real Estate Income Trust, Inc.


text: Our CIO is responsible for the strategic leadership and direction of the Company's information technology organization. As a part thereof, the Company has implemented an information security program, directly overseen by our CISO, that consists of controls and processes designed to prevent, detect, and manage reasonably foreseeable cybersecurity risks and threats, and which is based on recognized best practices including the National Institute of Standards and Technology ("NIST") Cyber Security Framework ("CSF") and Payment Card Industry Data Security Standard ("PCI DSS"). Our CISO, who has over 39-years of industry experience, and his team, have relevant education and experience assessing and managing cybersecurity programs and cybersecurity risks across a mix of enterprises, including the retail industry. Together with a third-party, the CISO and his team also operate a 24/7 Security Operations Center to monitor the cybersecurity environment and coordinate escalation and remediation of alerts, and we incorporate many other resources to maintain readiness to withstand and respond to a cyber or other data security incident including but not limited to incident response tabletop exercises, system recovery exercises, simulated phishing email exercises and security awareness training.

companyName: CASEYS GENERAL STORES INC

ticker: CASY


text: We are a holding company and our operations are conducted substantially in China by our China subsidiary. Our PRC subsidiary, the main operating entity of ours, has implemented comprehensive internal policies and measures on protection of cyber security, data privacy and personal information to make sure its compliance with relevant PRC laws and regulations. The main internal policies and measures are as follows: for customer data processing, our PRC subsidiary deploys the access control mechanism on the server side, adopts the principle of minimum authorization for the staff who may contact end users' personal data; our PRC subsidiary's operating systems and database systems have password complexity requirements; (iii)

companyName: ENTREPRENEUR UNIVERSE BRIGHT GROUP

ticker: EUBG


text: Phishing Scams: Employees might be targeted with deceptive emails to steal sensitive information or gain unauthorized access to systems resulting in unintentional loss of data.

companyName: YORK WATER CO

ticker: YORW


text: Some key safeguards we have undertaken to assess, identify and manage material risks from cybersecurity threats include, but are not limited to: • Engaging an independent audit firm to conduct a System and Organization Controls ("SOC") 2 audit of the Company in 2024; • Designing information security policies based on the International Organization Standardization ("ISO") 27001 framework; • Maintaining well-documented processes to provide and remove access, for security incident response, for IT change control and for secure software development lifecycle; • Conducting regular system patching; • Conducting frequent, independent third-party vulnerability and penetration testing; • Providing access on a "need to know" basis applied with "least privilege" principle; • Requiring multi-factor authentication for system access; • Protecting the use of data centers with physical and environmental controls; • Encrypting data at rest and in transit; • Requiring regular, independent SOC 1 and/or SOC 2 audits for key SaaS providers; • Requiring third-parties to have information risk management processes; • Requiring regular security awareness training, including annual online security awareness training, for all users of our systems, which covers topics like phishing, social engineering, mobile and device security and protection of sensitive information; • Testing awareness by sending regular test phishing emails; • Monitoring security 24/7/365; and • Providing for system redundancy and resilience to help ensure business continuity.

companyName: HEIDRICK & STRUGGLES INTERNATIONAL INC


text: Our cybersecurity risk management strategy is a separate component of our overall risk management process and is designed to protect our assets, including information technology systems, data, and operations, from cybersecurity threats. This involves: • Continuous monitoring and assessment of our cybersecurity posture. • Implementation of security measures such as firewalls, intrusion detection systems, and encryption. • Ongoing cybersecurity training and testing of our employees. • Regular cybersecurity assessments and penetration testing. • Vendor risk management to ensure third-party compliance with our cybersecurity standards.

companyName: HAWKINS INC

ticker: HWKN


text: Management is responsible for identifying, assessing and managing material cybersecurity risks on a day-to-day basis. The Company's Global Cybersecurity Steering Committee, comprised of the CTO, CISO and representatives from internal audit, legal, finance, privacy and human resources, is responsible for overseeing the Company's cybersecurity controls and generally meets on a quarterly basis. The Company's global cybersecurity organization, led by the CISO, is responsible for developing and implementing cybersecurity policies and procedures and identifying potential risks across the Company and works closely with dedicated cybersecurity personnel at the Company's business units. The Company's CTO assumed his position in June 2025 after serving in various leadership and technology roles at the Company's subsidiary News Corp Australia since 2012, including as CTO from 2020. He has extensive experience in information technology infrastructure and risk management, digital media and the management of digital networks. The Company's CISO has been in his position since December 2024 after serving in various leadership and information security roles at the Company since 2021. He has over two decades of industry experience in cybersecurity, information governance and risk management at large media and technology companies. As part of the Company's cybersecurity program, described above, the CISO is informed about and monitors the Company's prevention, detection, response, mitigation and remediation efforts related to cybersecurity threats through regular communication and reporting from the Company's cybersecurity team. The CISO works closely with representatives from the Company's legal group, including to oversee compliance with legal, regulatory and contractual security requirements. The CISO provides regular updates to the CTO and the Global Cybersecurity Steering Committee and to other members of executive management, as appropriate. The Company's reporting framework also includes its incident response policy and plan and other policies and processes which set forth specific procedures for internal and external reporting in the event of a cybersecurity incident, including notification to the Audit Committee or the Board of Directors, as appropriate.

companyName: NEWS CORP

ticker: NWSA


text: The Company maintains an incident response plan. Our incident response plan coordinates the actions we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to address potentially applicable legal obligations and mitigate brand and reputational damage. Our incident response plan is updated as appropriate in response to changes within our organization or in response to external factors that may impact us. We test our incident response plan by conducting tabletop exercises on an annual basis.

companyName: Fortune Brands Innovations, Inc.

ticker: FBIN


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our executive leadership team and led by the Vice President of Informatics, who has more than 20 years of experience in information technology and oversees the Informatics department which includes the Company's hardware, software, help desk, and cybersecurity team.

companyName: Personalis, Inc.

ticker: PSNL


text: We also maintain insurance coverage that, subject to its terms and conditions, is intended to help us mitigate certain costs associated with cybersecurity incidents.

companyName: STARBUCKS CORP

ticker: SBUX


text: Our CISO, who has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at the Company and elsewhere, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business. The CISO receives reports on cybersecurity threats from industry threat reports, and the team members in Information Security who are responsible for various parts of the business on an ongoing basis and in conjunction with management regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CISO and the team work closely with Legal and Internal Audit to oversee compliance with legal, regulatory, and contractual security requirements.

companyName: Consensus Cloud Solutions, Inc.

ticker: CCSI


text: The information security program, policies, and standards are managed by the Bank's Information Security Officer (the "ISO"), who leads the enterprise wide technology risk management function. The ISO acts as the second line of defense and provides risk oversight for the Bank's technology operating infrastructure and operations. The ISO manages testing of technology controls, technology risk assessments, risk reporting, information security third-party due diligence, monitoring the implementation of risk mitigation actions, and tracking their effectiveness over time. The Bank's internal auditors and Board of Directors act as the third line of defense, providing the independent assurance function. In addition to the above risk management framework, we engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third -party specialists. We also maintain a third -party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. Additionally, we actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections for any portion of our workforce that has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to opine on their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: Bogota Financial Corp.

ticker: BSBK


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including phishing training, regular network and endpoint monitoring, audits, vulnerability assessments, to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance; Management" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by the General Counsel and third-party information technology and security providers who act as our information technology team.

companyName: PALVELLA THERAPEUTICS, INC.

ticker: PVLA


text: All employees and third-party contractors with access to the Company's IT infrastructure must annually acknowledge that they have read and understand the IT User Acceptance Policy. Employees and contractors must also complete information security awareness training upon initial hire and annually thereafter.

companyName: JACK IN THE BOX INC

ticker: JACK


text: Cybersecurity risk management is integrated into our broader Enterprise Risk Management ("ERM") framework. FactSet's ERM program is designed to identify, prioritize and assess the most significant risks that could impact our ability to achieve our strategic business objectives. Our information security leadership team, in concert with our ERM team, reviews our cybersecurity risks each quarter through our enterprise risk assessment process.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: The Company's Senior Vice President, Controller and Principal Accounting Officer is responsible for managerial oversight of our cybersecurity program and reporting on cybersecurity matters to the Audit Committee of the Board of Directors and management. Our Senior Vice President, Controller and Principal Accounting Officer oversees the cybersecurity team, which include members of our internal IT department and is also supported by third-party service providers.

companyName: IRONWOOD PHARMACEUTICALS INC

ticker: IRWD


text: We maintain an incident response plan that outlines the steps to be taken in the event of a cybersecurity incident. This plan includes procedures to escalate, contain, investigate and remediate the incident, as well as to comply with any legal reporting requirements and communicate with affected stakeholders. Our employees receive regular training on cybersecurity best practices, emphasizing the protection of financial information. We foster a culture of cybersecurity awareness and responsibility throughout the organization.

companyName: Stardust Power Inc.

ticker: SDST


text: The Cybersecurity Committee meets quarterly and delivers updates to management periodically and to the Audit Committee on an annual basis (and as needed). Under its charter, our Audit Committee, comprised of independent directors from our Board, must conduct at least annual reviews of any emerging cybersecurity developments and threats and the strategies to mitigate cybersecurity risks. The Cybersecurity Committee also delivers periodic updates to the Board on the status of the information security program, including but not limited to relevant cyber threats, roadmap and key initiative updates, and the identification and management of information security risks. The Board reviews cybersecurity opportunities relating to our business strategy, and cybersecurity-related matters are also factored into business continuity planning.

companyName: Bristow Group Inc.

ticker: VTOL


text: Our CISO has 25 years of experience in industries including government, retail, and manufacturing, and industry certifications including CISSP and GIAC. Our CISO also has experience in forensic investigations, strategic risk management, and security program development. The information security team has an average of 15 years of prior work experience in roles including incident response, forensics, vulnerability management network security administration, fraud prevention, and other governance, risk, and compliance areas. The team maintains subject matter expert level knowledge in cybersecurity frameworks and governance organizations such as NIST, ISO 27001, and PCI along with industry certifications commensurate with their roles.

companyName: Camping World Holdings, Inc.

ticker: CWH


text: We work on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. We believe we are positioned to meet the requirements of the SEC. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach.

companyName: Mobile Global Esports, Inc.

ticker: MGAM


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents. We face ongoing risks from certain cybersecurity threats, and we cannot provide assurance that, if those risks materialize, our business strategy, results of operations or financial condition will not be materially affected in the future. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: POWER SOLUTIONS INTERNATIONAL, INC.

ticker: PSIX


text: At least annually, we conduct a cybersecurity risk assessment using the FFIEC Cybersecurity Assessment Tool that considers information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee, and members of management.

companyName: Eagle Bancorp Montana, Inc.

ticker: EBMT


text: We evaluate cybersecurity risk independently, and we have integrated cybersecurity risk into the Company's overall Enterprise Risk Management ("ERM") process. The IT function is responsible for cybersecurity risk and reports to our Chief Administrative Officer. The Chief Financial Officer and the Director of Treasury and Risk Management are responsible for our ERM process, which is performed annually and updated throughout the year and involves a cross-functional group of management, including our Director of IT who has over 20 years of information technology experience. Pursuant to our ERM process, cybersecurity risk is evaluated based on likelihood, severity, speed of onset and persistence (the duration of time during which the organization could be impacted). The Company also leverages third parties, where needed, in connection with cybersecurity risk management, strategy and incident response.

companyName: WARRIOR MET COAL, INC.

ticker: HCC


text: The Company's full Board of Directors oversees enterprise risks and has delegated oversight to the Audit Committee of the Cibus Board of the Company's data privacy and cybersecurity risks and provides input on the Company's cyber and information security strategy. The Council reports the status of the Company's cybersecurity program to the Audit Committee and, periodically, to the Board. The Board and Audit Committee regularly review these reports and discuss policies with respect to cybersecurity and information technology risks, including how these risks are being identified, assessed, and managed.

companyName: Cibus, Inc.

ticker: CBUS


text: To date, we are not aware of any cybersecurity incidents that have had a material adverse effect on our operations, business, results of operations, or financial condition. We have, however, experienced routine attempted phishing attacks, malware probes, and other common malicious activity. These attempts have been contained without material impact.

companyName: NightFood Holdings, Inc.

ticker: NGTF


text: Information security matters, including managing and assessing risks from cybersecurity threats, remain under the oversight of the Company's Board of Directors, or the Board. The Audit Committee of the Board, or the Audit Committee, also reviews the adequacy and effectiveness of the Company's information security policies and practices and the internal controls regarding information security risks. The Audit Committee receives regular information security updates from management, including our Chief Security Officer and members of our security team. The Board also receives annual reports on information security matters from our Chief Security Officer and members of our security team.

companyName: NVIDIA CORP

ticker: NVDA


text: Organizations across the globe are experiencing cybersecurity incidents at an increasing rate, and cybersecurity threats are increasingly sophisticated and constantly evolving. We have developed and maintained policies, procedures, and controls to mitigate material risks from cybersecurity threats, and assess and disclose information to investors concerning material cybersecurity incidents. These risks are evaluated on an ongoing basis as part of our overall risk management strategy. As discussed in more detail below, we have policies and procedures in place to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, train and raise awareness of cybersecurity threats amongst employees, detect intrusions into our systems, and respond to cybersecurity incidents. Despite these efforts, no system is impenetrable, and we cannot provide assurances that we will prevent every attack or detect every incident timely.

companyName: MEDIFAST INC

ticker: MED


text: Because the Company is aware of the risks associated with third-party service providers, management implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure they meet our cybersecurity standards.

companyName: HMN FINANCIAL INC


text: We have established and implemented processes to assess, identify and manage material cybersecurity risks. Cybersecurity risks are assessed, identified and managed by our Director of Global Cybersecurity, with direct supervision by our Chief Information Officer ("CIO") and with the assistance of our internal audit and legal teams. Our Director of Global Cybersecurity shares information regarding such risks with our management's senior level information security council (the "Information Security Council"), which consists of our CIO, Chief Financial Officer, Chief Technical Officer, Chief Legal Officer & Corporate Secretary, Vice President of Strategy and Director of Internal Audit & Enterprise Risk Management, and which supports the Audit Committee's oversight of cybersecurity risk, including by providing regular reports on various cybersecurity matters. We have in place robust physical, technical, administrative, and organizational controls for the securing of our information systems.

companyName: Atmus Filtration Technologies Inc.

ticker: ATMU


text: Security awareness and training We provide ongoing security awareness and training to educate internal users on how to identify and report potential issues. Phishing emails are discussed on a regular basis with employees to ensure proper protocols are followed. We also provide periodic updates to employees on emerging cybersecurity trends and ways to protect themselves and the Company.

companyName: SANUWAVE Health, Inc.

ticker: SNWV


text: We seek to identify and manage risks from cyber threat intelligence and lessons learned from known cyber incidents with our cyber risk management process and include these within our cyber risk strategy through major technology enhancements and projects. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. Cybersecurity risks continue to increase, and as set out in our risk factors our services may be affected by cybersecurity and data security incidents, including but not limited to spyware, viruses, phishing, and other spam emails, denial of service attacks, data theft, computer intrusions, outages, and similar events, which could be material to the Company. See "Item 1A. Risk Factors" in this Form 10-K for additional discussion on the risks of future cyber incidents to our results of operations and financial condition.

companyName: Coupang, Inc.

ticker: CPNG


text: In light of the critical importance of cybersecurity to our business, in the spring of 2023, our board of directors formed a standing cybersecurity committee. The cybersecurity committee meets quarterly and is responsible for reviewing with management our cybersecurity and other information technology risks, controls and processes, including the processes used to prevent or mitigate cybersecurity risks and respond to cybersecurity events. These reports include updates on our information security risks and threats, any notable incidents, escalations or third-party risks, the status of projects to strengthen our information security systems, assessments of the information security program, the emerging threat landscape and company security culture. The CISO provides reports at least quarterly to the cybersecurity committee as well as to our Chief Executive Officer, Chief Technology Officer, and other members of our senior management, as appropriate. The cybersecurity committee also receives quarterly updates from our legal department and third-party experts. Our cybersecurity committee provides regular updates to the board of directors on such reports, and coordinates with the audit committee of the board of directors with respect to any risks with implications for our financial reporting, accounting, internal controls or other matters presenting significant financial risk.

companyName: BILL Holdings, Inc.

ticker: BILL


text: We acknowledge the potential cybersecurity risks inherent in our relationships with third-parties. Accordingly, we have implemented a third-party risk management program to identify and oversee such risks. This program relies on key elements including risk assessment, due diligence, contractual provisions and ongoing monitoring to identify and mitigate impacts from high-risk third-parties and of specific risks. We use security risk assessment questionnaire tools to identify high-risk third-parties, which we believe allows us to effectively assess and mitigate potential security vulnerabilities.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: Proactive Security Measures and Threat Management We employ a multi-layered defense strategy, leveraging advanced threat intelligence, automation, and security analytics to proactively detect, prevent, and respond to cyber threats. Our core security practices include: continuous threat monitoring and response utilizing real-time security operations centers and next-generation endpoint detection and response to vulnerability assessments and penetration testing conducted through automated and manual assessments with prioritized remediation workflows to enhance security across infrastructure, applications, and client environments;

companyName: INTELLIGENT PROTECTION MANAGEMENT CORP.

ticker: IPM


text: Our IRP contains tools, and guidance related to cybersecurity events and is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate incidents as well as comply with applicable legal obligations. In addition, as part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.

companyName: Karyopharm Therapeutics Inc.

ticker: KPTI


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan and is integrated with our overall enterprise risk management program, sharing common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. While we may not meet any particular standard, specification or requirement of the Center for Internet Security Critical Security Controls, we utilize such controls as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: QUANTA SERVICES, INC.

ticker: PWR


text: The Committee receives periodic reports from management on potential cybersecurity risks and threats and receives presentations on cybersecurity topics from Vornado's Chief Information Officer. The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.

companyName: ALEXANDERS INC

ticker: ALX


text: Cybersecurity is a key component of the Company's risk mitigation strategy. As such, a multi-year cybersecurity strategy and roadmap are developed and incorporated into Tapestry's long-range planning and capital allocation process.

companyName: TAPESTRY, INC.

ticker: TPR


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity threats and incidents through various means, which may include briefings from internal security personnel; and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: ATN International, Inc.

ticker: ATNI


text: Our CIO and our Vice President, Information Security lead our global information security organization and are responsible for overseeing our information security program. Our Vice President, Information Security has over 25 years of industry experience, including serving in similar roles, building, leading and overseeing cybersecurity programs at other private and public companies. Team members who support our information security program have relevant educational and industry experience, including application security, security operations, forensic and incident response, governance, risk and compliance.

companyName: Bandwidth Inc.

ticker: BAND


text: We developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical information technology ("IT") systems and information.

companyName: CORNING INC /NY

ticker: GLW


text: Our efforts are designed to maintain the confidentiality, integrity, and availability of our information and operational technology systems and the data stored on those systems. The program includes: • Conduct periodic risk assessments to identify material cybersecurity risks in our critical IT systems • Monitor for external threats and manage incident response • Engage third-party security providers for penetration testing and program reviews based on National Institute of Standards and Technology ("NIST") standards • Perform internal audit reviews of IT-related controls • Assess cybersecurity risks of third-party vendors • Train employees regularly, including phishing simulations The cyber security program is continually adapting to the evolving threat landscape and technology developments.

companyName: EDGEWELL PERSONAL CARE Co

ticker: EPC


text: The Director of Information Technology & Cybersecurity has served in various roles in information technology and information security for over 25 years, including the design and management of operational and cybersecurity activities of two large public companies. The Director of Information Technology & Cybersecurity holds undergraduate and graduate degrees in computer science and is certified in NIST, CMMC, CIS, and GDPR. The Company's CEO and CFO each hold undergraduate and graduate degrees in their respective fields, and each has over 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: EASTERN CO

ticker: EML


text: Our cybersecurity-specific risk assessment process, benchmarks our practices against standards set by the National Institute of Standards and Technology ("NIST"), International Organization for Standardization ("ISO"), and the Center for Internet Security ("CIS"), and includes expert-led penetration tests to evaluate the security of our information systems, as such term is defined in Item 106(a) of Regulation S-K.

companyName: ARTIVION, INC.

ticker: AORT


text: McKESSON CORPORATION We develop and maintain systems and operate programs that seek to mitigate the impact of cybersecurity incidents. In the face of sophisticated and rapidly evolving attempts to overcome our security measures, we must continually monitor and update these systems and programs. Both intentional and unintentional occurrences have caused, and could cause in the future, a variety of adverse business impacts to our information systems and data. See "Risk Factors" in Item 1A of Part I above for additional information on risks related to our business, including for example, risks related to privacy and data protection, cybersecurity incidents, third-party relationships, and continuity of our information systems and networks, operational technology, and technology products or services.

companyName: MCKESSON CORP

ticker: MCK


text: 5. Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We have implemented communication channels with our key third-party vendors to communicate regarding potential cybersecurity risks and incidents, and generally seek to include appropriate security clauses in our contracts with our vendors, including notification requirements.

companyName: SUTRO BIOPHARMA, INC.

ticker: STRO


text: Our CDDO and CISO have extensive experience in cybersecurity. Our CDDO has served in his role since September 2024. He has over 15 years of experience in digital transformations, enterprise technology, artificial intelligence, and data management. Our CISO has served in various roles in Information Technology for over 25 years, including 15 years in Information Security. He holds a B.S. in Cybersecurity and Information Assurance, along with industry certifications that include the Information Systems Audit and Control Association Certified in Risk and Information Systems Control, Certified Information Security Manager, and International Information System Security Certification Consortium Certified Information Systems Security Professional certifications.

companyName: DECKERS OUTDOOR CORP

ticker: DECK


text: We engage in the periodic assessment and testing of our cybersecurity policies, standards, processes and practices, including through audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. To assist with such assessment and testing, we engage assessors, consultants, auditors, and other third parties to perform assessments on our cybersecurity measures, including for third-party testing and certifications (as described above under "Technical Safeguards"), information security maturity assessments, customer audits, and independent reviews of our information security control environment and operating effectiveness. The material results of such assessments, audits and reviews are reported to our audit committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided.

companyName: TWILIO INC

ticker: TWLO


text: Cyber threats are considered one of the most significant risks facing financial institutions. Because the Trust has no directors, principal officers or employees, the Sponsor is responsible for managing cybersecurity risks to the Fund. To mitigate risk from cyber threats, Invesco Ltd. (“Invesco”), the Sponsor’s parent company, has a designated Global Chief Security Officer (GCSO) who leads the global security department that is responsible for identifying, assessing, and managing cybersecurity threats across the Invesco organization. The GCSO experience in the public and private sectors, specializing in security, investigations, and incident response. The Global Security Department oversees, among others, the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, and Corporate Security. This converged security structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees, and critical assets safe, upholding privacy rights, while enabling a secure and resilient business.

companyName: Invesco Galaxy Bitcoin ETF

ticker: BTCO


text: The Audit Committee of our Board of Directors, which is composed of all non-employee directors, is responsible for oversight of our efforts to eliminate cybersecurity risks. The Audit Committee meets regularly with our Chief Executive Officer and Chief Financial Officer and, in turn, reports its finding to the Board of Directors.

companyName: AIR INDUSTRIES GROUP

ticker: AIRI


text: Cybersecurity risks are incorporated into our overall risk management program. If a cybersecurity risk is identified as high-risk, a response and mitigation plan is developed, and progress updates on the plan are routinely reported to the Technology Risk Management Committee and tracked by the Audit Committee as part of our overall risk management process.

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: We have identified a material weakness in our information technology general controls. These controls over user access to certain information technology systems that support our financial reporting process were not properly designed and implemented. We have since made efforts to remediate the identified material weakness. There have otherwise been no risks from cybersecurity threats at the Company to date that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Governance.

companyName: Clever Leaves Holdings Inc.

ticker: CLVR


text: Material cybersecurity risks, threats & incidents To date, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial position. However, there can be no guarantee that we will not be the subject of future threats or incidents, and we can give no assurance that we have detected all cybersecurity incidents or cybersecurity threats. Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.

companyName: Babcock & Wilcox Enterprises, Inc.

ticker: BW


text: Integration Into Overall Risk Management Cybersecurity risk management is integrated into our broader enterprise risk management framework to promote a culture of cybersecurity awareness. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes throughout Trinity. Our IRM team works closely with our information technology department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Cybersecurity risks are assessed by Trinity's IRM team, and the risk assessment is aligned with business-level processes and is consistent with Trinity's standard enterprise risk management methods and thresholds. Our IRM organization regularly consumes a variety of threat intelligence and information security news sources to inform and align risk management decisions to current threats and threat landscapes.

companyName: TRINITY INDUSTRIES INC

ticker: TRN


text: Cybersecurity Risk Management and Strategy ORIX USA has engaged HCLTech ("HCL") to manage all infrastructure and cybersecurity services for ORIX USA and its subsidiaries, under the governance of the ORIX information and cybersecurity leadership team. HCL has over twenty-five years' experience in cybersecurity, nine cybersecurity delivery centers strategically placed across the globe, and employs over 7,000 cybersecurity professionals. The ORIX information and cybersecurity leadership team and HCL are considered the "ORIX USA Information Technology and Cybersecurity Team".

companyName: Lument Finance Trust, Inc.

ticker: LFT


text: The Company's Chief Executive Officer ("CEO"), through the appropriate reporting channels, is responsible for the cybersecurity risk management program. The Company's information technology department is responsible for developing and implementing the Company's cybersecurity policies, procedures, and strategies; overseeing the Company's cybersecurity risk assessment process; and monitoring the Company's cybersecurity risk profile.

companyName: Thermon Group Holdings, Inc.

ticker: THR


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. We continue to extend our cybersecurity capabilities, with advanced cybersecurity technology, processes and resources, that are designed to help us to actively identify, protect, detect, respond to, and recover from risks and threats, but nonetheless we have in the past been subject to cyberattacks and continue to face cybersecurity risk threats. Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us. However, cybersecurity attack techniques change frequently, and with increased volume and sophistication of such attacks, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents that could materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our systems, or those of any of our CROs, manufacturers, other contractors, third party service providers or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of its proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to its brand and material disruption of our operations."

companyName: Neurogene Inc.

ticker: NGNE


text: We have established and implemented a cybersecurity risk management program and information privacy program (collectively, our "Cybersecurity and Privacy Programs") that are collectively intended to protect the confidentiality, integrity, and availability of our critical information systems and the information residing therein. These programs are integrated into, and form a part of, our overall enterprise risk management program, and share similar methodologies, reporting channels and governance processes to those that apply across the broader enterprise risk management framework.

companyName: GoodRx Holdings, Inc.

ticker: GDRX


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. Our board of directors is responsible for the oversight of risks from cybersecurity threats.

companyName: NETLIST INC

ticker: NLST


text: Our Board of Directors is committed to maintaining a well-informed and security-aware business by regularly engaging through updates on the organization's roadmap and evolving threat landscape.

companyName: NU SKIN ENTERPRISES, INC.

ticker: NUS


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. As needed, the audit committee of our board of directors (the "Board") provides oversight over cybersecurity risk and provides updates to the Board regarding such oversight. The audit committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: Corbus Pharmaceuticals Holdings, Inc.

ticker: CRBP


text: Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. To mitigate these risks and protect sensitive customer data, financial transactions and our information systems, the Company has implemented a comprehensive cybersecurity risk management program, which is a component of its overarching enterprise risk management program. Key components of the cybersecurity risk management program include: • A risk assessment process that identifies and prioritizes material cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the Board of Directors. • A third-party Managed Detection and Response ("MDR") service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting. • A dedicated cybersecurity team covering all critical cyber defense functions such as engineering, data protection, identity and access management, insider risk management, security operations, threat emulation and threat intelligence. • A training program that educates employees about cybersecurity risks and how to protect themselves from cyberattacks. • An awareness program that keeps employees informed about cybersecurity threats and how to stay safe online. • An incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident, which is tested on a periodic basis.

companyName: TEXAS CAPITAL BANCSHARES INC/TX

ticker: TCBI


text: Our cybersecurity risk management program includes the following: • A dedicated staff of cybersecurity and risk management professionals; • Defined security policies and standards; • Annual mandatory employee cybersecurity and privacy compliance awareness training; • Cybersecurity tooling for detecting and responding to cyber incidents; • Cybersecurity incident response and major crisis plans that govern activities such as detection, coordination, remediation, recovery, and escalation to senior management and, where appropriate, our Audit and Finance Committee and our Board; • Disaster recovery plans; • Periodic tabletop exercises to promote awareness and improve internal processes; • Periodic penetration testing and vulnerability management processes; and • Third-party risk assessments for suppliers and vendors, which may require such third parties to sign data processing agreements, comply with particular security controls, or complete an additional security and privacy assessment.

companyName: HOLOGIC INC

ticker: HOLX


text: Chevron's Chief Information Officer (CIO) oversees Chevron's broader IT program, which includes the company's cybersecurity program and its ability to remediate and recover from a cybersecurity incident to minimize business and operational impacts. Chevron's CIO joined Chevron in 2024, bringing more than 20 years of experience leading global innovation initiatives in digital, data, full supply chains, vehicle commerce, energy, and IT operations for technology and automotive companies. Chevron's Chief Information Security Officer (CISO) reports to the CIO and leads a global cybersecurity team.

companyName: CHEVRON CORP

ticker: CVX


text: Cybersecurity Program Overview As part of our overall risk management processes and procedures, we have instituted a cybersecurity program designed to identify, assess, and manage material risks from cybersecurity threats. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity program, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, as needed. We also depend on and engage various third parties, including suppliers, vendors, and service providers in connection with our operations. Our risk management, legal, and compliance personnel identify and oversee material risks from cybersecurity threats associated with our use of such entities. CHICAGO ATLANTIC BDC, INC.

companyName: Chicago Atlantic BDC, Inc.

ticker: LIEN


text: The Board and the Audit Committee actively discuss cybersecurity risks with management and among themselves. The CIO reports on the Company's Cybersecurity Program and the Company's approach to cybersecurity risk management to the Audit Committee of the Board of Directors two times a year and to the full Board periodically, as appropriate. These reports include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the information security program, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the emerging threat landscape, technological trends and information security considerations arising with respect to the Company's peers and third parties.

companyName: BORGWARNER INC

ticker: BWA


text: Assessment, Identification and Mitigation of Cybersecurity Threat Risk Our cybersecurity threat strategy is based on prevention, detection and mitigation using layered defenses, continuous assessment, monitoring through logging and correlation, vulnerability scans, cyber threat intelligence, end-point detection and response (EDR), and regular defense testing through simulations, penetration tests and table top exercises. While our cybersecurity policies, practices and programs may vary by location or by service line, our overall cybersecurity management program is based on the ISO 27001 standard. Our Information Security Office regularly monitors alerts and threat levels, trends, and remediation efforts, conducts post-incident reviews, conducts maturity testing to assess our processes and procedures and the threat landscape, reviews our operational policies and procedures, and conducts an annual risk assessment as described above. We believe that these steps are useful tools in identifying and assessing risks, giving our team key information and insights used to manage those risks to help protect our clients, families, employees, vendors, investors, and our data and intellectual property.

companyName: BRIGHT HORIZONS FAMILY SOLUTIONS INC.

ticker: BFAM


text: Our CISO is supported by and is a member of our Cybersecurity Strategy and Risk Committee ("CSRC"), which is a management-level governance body for oversight of all of our cybersecurity risk. Our VP of Product Security is also a member of the CSRC. On a quarterly basis, our CSRC receives information from our CISO regarding BD's enterprise IT, manufacturing and distribution OT and product security programs, including the Company's strategy and progress on key initiatives. We also have an executive-level Enterprise Risk Committee (ERC) that oversees our ERM program and aims to create an enterprise-wide culture that promotes open discussion regarding risk and opportunities and integrates effective risk management into our goals and objectives. As part of integrating cybersecurity risk management into our ERM program, our ERC receives updates from our CIO and CISO on BD's cybersecurity risk management strategy and program on a regular basis. In addition to our CSRC and our ERC, we have established processes providing for the escalation of certain cybersecurity incidents and breaches. We maintain a global response plan that sets forth a detailed incident management and reporting protocol designed to respond to cybersecurity incidents and breaches appropriately and efficiently. Our operational team is responsible for communicating the impact and status of certain cybersecurity incidents and breaches to senior management, including the CISO, based on its assessment of the significance of the cybersecurity incident or breach. We also have a committee consisting of senior members of our management, including our CIO and CISO, to evaluate cybersecurity incidents and breaches reported to the committee by our CISO on an ad-hoc basis for potential material impacts on BD, including its financial condition and results of operations, and assess BD's public disclosure obligations. The CIO, CISO and other members of the committees are informed about the status, effectiveness and risks associated with our cybersecurity risk management program through their management of and participation in the cybersecurity risk management processes, policies and operations described above.

companyName: BECTON DICKINSON & CO

ticker: BDX


text: Our CTO has a versatile background in computer science, machine learning, software engineering and data science with over 15 years of industry experience, building automated machine learning systems and solutions in the ad tech, customer service, and healthcare industries. Prior to joining Recursion, our CTO held various leadership roles providing strategic leadership for the company's IT organization.

companyName: RECURSION PHARMACEUTICALS, INC.

ticker: RXRX


text: Our cybersecurity risk management program is aligned with our overall enterprise risk management programs and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management programs to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Arista Networks, Inc.

ticker: ANET


text: Chief Information Security Officer, who reports to the Chief Operating Officer, has over 27 years of experience managing information technology and cybersecurity matters and is experienced in cloud, infrastructure management, business operations, and cybersecurity, and, together with our Information Technology Steering Committee, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. We have not identified risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected us, and we face ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A "Risk Factors." under the heading "Systems failures, interruptions and cybersecurity breaches in our information technology and telecommunications systems and of third-party service providers could have a material adverse effect on us."

companyName: BROADWAY FINANCIAL CORP \DE\

ticker: BYFC


text: As part of our cybersecurity risk management program, we maintain processes to assess and review the cybersecurity practices of third-party vendors and suppliers. Prior to engaging key third-party vendors and suppliers, we conduct a security assessment and, as appropriate, include security requirements in contracts.

companyName: Climb Bio, Inc.

ticker: CLYM


text: We maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our cybersecurity risk management processes are being integrated into our overall risk management processes. We are making efforts to incorporate cybersecurity considerations as a part of our business processes. We engage with external cybersecurity experts, including assessors, consultants, and auditors, to enhance our cybersecurity measures and ensure compliance with industry best practices. For example, a comprehensive cyber risk assessment, both physical and logical, was conducted by a third party, serving as an external penetration test to validate our security posture. We have established processes to oversee and manage cybersecurity risks associated with our use of third-party service providers, ensuring they adhere to our security standards. We review third-party service provider contracts to ensure they contain data privacy and security provisions, aligning with our standards and regulatory requirements. Additionally, we have established a Technology Review Committee ("TRC")

companyName: Purple Innovation, Inc.

ticker: PRPL


text: Our cybersecurity governance committee led by our management team and our CIO with 15 years of experience in cybersecurity and a CISSP certification, bears the primary responsibility for assessing and managing material cybersecurity risks. Regular meetings are held to review security performance metrics, identify security risks, assess the status of security enhancements, and make recommendations on security policies, procedures, service requirements, and risk mitigation strategies.

companyName: ICAHN ENTERPRISES L.P.

ticker: IEP


text: The Trust does not have computer systems or networks. Pursuant to the terms of the Trust Agreement, the Trust's affairs are managed by USCF. USCF has implemented an information security program that is focused on ensuring the security and protection of computer systems and oversight of third-party service providers. This program includes specific provisions pertaining to data security and the security of information that, if disclosed, could have detrimental effects on the Trust, USCI and CPER. Such provisions relate to the handling of information and computers, as well as the protection of computer systems and software from unauthorized persons. As needed, but no less frequently than annually, USCF evaluates its cybersecurity risk profile in accordance with its compliance policies and procedures. The risk assessment aims to confirm that USCF's policies are being followed and enforced, and to identify risks that may have otherwise been unknown. To mitigate the risks from cybersecurity threats posed by third parties, USCF conducts due diligence on its critical third-party service providers with respect to (1) the cybersecurity programs and policies that they have in place as well as how they safeguard sensitive information, and (2) how those programs and policies apply to customers, including USCF and the Trust.

companyName: United States Commodity Index Funds Trust

ticker: USCI


text: Security Policy and Requirements As part of our overall risk management program, we have adopted our Information Security Policy which details the overall risk-based framework and governance for the management and security of our information technology assets and information. The policy applies to everyone who accesses our data or information resources and all of our information systems and resources, including third parties we engage. Our program aligns with the NIST 2.0 cybersecurity framework.

companyName: EDGEWELL PERSONAL CARE Co

ticker: EPC


text: While we have implemented robust practices to mitigate cybersecurity risks, and prior cybersecurity threats have not materially affected our business strategy, results of operations or financial condition, we could be negatively impacted by a cybersecurity breach, through cyber-attack, cyber intrusion, insider threats, supply chain incidents, or otherwise, or other significant disruption of our IT networks and related systems or of those we operate for certain of our customers. See "Item 1A. Risk Factors" in this Report for further discussion of specific risks related to cybersecurity threats.

companyName: L3HARRIS TECHNOLOGIES, INC. /DE/

ticker: LHX


text: Information security and protection of our data is important to Wesco, our customers and suppliers. As a global company, we face various cybersecurity threats, ranging from phishing, ransomware and denial-of-service attacks to more recent threats incorporating the use of artificial intelligence. Our suppliers, third-party vendors, service providers, customers, and other business partners are also vulnerable to similar cybersecurity risks. In response to this evolving cybersecurity threat landscape, we have implemented a cybersecurity risk management program that follows a comprehensive, multi-layered approach to securing our data and business systems from attack, compromise or loss, guided by the National Institute of Standards and Technology (NIST) Cybersecurity Framework. This includes the combination of leading technologies, physical and organizational safeguards, including a robust suite of security policies and procedures. We have a dedicated 24 hours per day/seven days per week Cybersecurity Operations team, with a third-party service provider, monitoring our environment for signs of attack and responding in real-time. Our implementation of a multi-layer and multi-provider portfolio of technologies is designed to deliver overlapping coverage against continually evolving cybersecurity threats with a strong defensive and response driven security posture. We evaluate risks, threats, intelligence feeds and vulnerabilities to adapt, mitigate or respond as appropriate to preserve a secure state. Additionally, we identify, assess and manage risks associated with our use of third-party service providers and other business partners and we maintain a comprehensive third-party risk management program to evaluate partners prior to onboarding, throughout the life of the relationship, and through the conclusion of the relationship. This program is designed to ensure our third-party partners adhere to Wesco's security policies and expectations as the threat landscape and the relationship evolve.

companyName: WESCO INTERNATIONAL INC

ticker: WCC


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee’s overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third-party vendor, of the Trustee’s cyber risk management program.

companyName: CROSS TIMBERS ROYALTY TRUST

ticker: CRT


text: Preparation—perform a risk assessment, identify sensitive assets, and build a Computer Security Incident Response Team (CSIRT). Our team includes an outside IT Cybersecurity consultant that provides managed services on a regular basis.

companyName: SCI Engineered Materials, Inc.

ticker: SCIA